Extracting prog: 9m38.135264351s Minimizing prog: 30m13.192435619s Simplifying prog options: 0s Extracting C: 20.15091605s Simplifying C: 11m22.484615769s extracting reproducer from 24 programs testing a last program of every proc single: executing 4 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-openat$cgroup_ro-landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH-landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH-openat$ptmx-openat$binderfs-openat$binderfs-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-dup3-dup3-renameat2-openat$binderfs-mmap$binder-syz_usb_connect$uac2-syz_usb_connect$uac2-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$MON_IOCG_STATS-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-ioctl$TIOCSETD detailed listing: executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) (async) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x109040, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) (async) r4 = dup3(r3, r2, 0x0) renameat2(r0, &(0x7f0000000280)='\x00', r0, &(0x7f00000002c0)='./file0\x00', 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) r6 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x10000000000) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) (async) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x1e, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x130, 0x0, &(0x7f0000000c80)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1068, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x2000000000033}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x400000001, 0x8}, @flat=@binder={0x73622a85, 0x1000, 0x2}}, &(0x7f0000000240)={0x0, 0xfffffe78, 0x50}}, 0x1000}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @request_death={0x400c630e, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000b00)={@flat=@weak_handle={0x77682a85, 0x100, 0x1}, @flat=@weak_binder={0x77622a85, 0x10b, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x1}}, &(0x7f0000000b80)={0x0, 0x18, 0x30}}}, @free_buffer={0x40086303, r6}], 0x0, 0x0, 0x0}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$cdc_ncm-syz_usb_control_io$cdc_ncm-setsockopt$inet6_tcp_TCP_ULP-mkdir-openat$fuse-mount$fuse-setresgid-utimes-syz_usb_control_io$cdc_ncm-syz_usb_control_io$rtl8150-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_connect$midi-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000020000402505a1a440000002030109025c0002010000000904000001020d0000052406000105241000000d240f0100000000060000010006241a0000000905810300020000000904010000020d00000904010102020d0000090582020002000000090503f53f39d33169b12395de019d9d8d07520c20664f05a7982976374e688c67f7f17c9dd09247bdb7fbcd84905d1bca7d24a81ebed7367b96c7f3d16eb5a8c6e2d2dbdafb00084b5b7618ad60c1918ce5a37e45fcbf660fb2916303b10dd6aeb6bc1731e8a1c757401e704723aac18830f01f278a797bf6eccb5ee5441341b3883dd3afd9d165a55220cfe0a2918efdc52e024eb9e3e44ef6bae1a0f47ad9c2d515298951651821c808159fbf09605617e11040a73626a3faa0ebdf2e5aed7dd8693b041b7299b5c6c1e5b33957b1c933748a"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) mkdir(&(0x7f0000000840)='./file0\x00', 0x145) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) setresgid(0x0, 0x0, 0xee01) utimes(&(0x7f0000000200)='./file0\x00', 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000080)={0x14, &(0x7f0000000040)={0x20, 0x34, 0xf, {0xf, 0x7, "c5984a926bc1433e2ed91f1d86"}}, &(0x7f0000000140)={0x0, 0x3, 0xf3, @string={0xf3, 0x3, "7bbc05a293951190558746304432ff5b195ce85e635b4b917859b61bf6fe0e2d82d2086f10acdea5a3bda37f7d39e933852367994b6e48f8344cfd9c589199ab1eea504469cbd204216e258fbd345289580ab8860cfac3c123099f845b13b76aafb271c860ecf818f9766a3a5f6449dd5852cd5995fc1a25cd5dd18a50dc553036c58662bb480f1184b3d7e847330b6f1e0a6f8f52b507b1243815562cad3c858d704bf4ae81010c8001babdb6ec5e5e54f4bb6bebe13cc04bb1774c8a85e3ea0379cca08493614541b2a867f1958a77d7afc9e53105e5aec7f9b8d577b265e6b7a584f38c929edb8d4ec9d23f94e28229"}}}, &(0x7f0000000540)={0x2c, &(0x7f0000000240)={0x40, 0x17, 0xa9, "30aa97c7a29bbb15c60e9583bf22411f9a170865fc80ccccf0598353b471483063c9a79e6ce69365b691b6322ace3b5a1395e7c5c388e0aad6a12a717941c714a04130eec77f81bdb130f931143ce0d8a86c37eaa3fe4836dbc0c2b929acd4d61580688d24f772500e818b2d52a6aa3e2b242f13254f2e21a6595fc1ecb8c23683e2c31df04e5eab34bbf31c30cfde7117dc7f0ce0b59de9cf480fc7d8da6288fbfb1d91b43cbb69c4"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x71}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f00000004c0)={0xc0, 0x5, 0x4, "9d642267"}, &(0x7f0000000500)={0x40, 0x5, 0x3, "6631fa"}}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000000c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x80, 0x1c, {0x401, 0xa08, 0xfffffffc, 0xb, 0x441, 0x5, 0x7fff, 0xfa97, 0x200, 0xd, 0x1fe, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = syz_usb_connect$midi(0x4, 0xd5, &(0x7f0000000580)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc3, 0x1, 0x1, 0x81, 0xa0, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x5, 0x1, 0x3, 0x20, 0x6, [@midi_out_jack={0xd, 0x24, 0x3, 0x5, 0xc, 0x3, [{0x81, 0x3}, {0x5, 0x1}, {0x0, 0xc}], 0x5}, @midi_in_jack={0x6, 0x24, 0x2, 0x3, 0xbb, 0x1}, @ms_header={0x7, 0x24, 0x1, 0x0, 0x7}, @ms_header={0x7, 0x24, 0x1, 0x2, 0x7}, @midi_out_jack={0x1b, 0x24, 0x3, 0x1, 0xf8, 0xa, [{0x0, 0x1}, {0xc4, 0x2}, {0x2, 0x2}, {0x5, 0x10}, {0x1, 0xfe}, {0x6f, 0x4}, {0x7, 0xeb}, {0x97, 0x3}, {0x4, 0x1}, {0x6, 0x7}], 0x17}, @ms_header={0x7, 0x24, 0x1, 0x8694, 0x7}, @midi_out_jack={0xb, 0x24, 0x3, 0x3, 0xf, 0x2, [{0x0, 0x9}, {0x4, 0x6}], 0x50}], [{{0x9, 0x5, 0xb, 0x8, 0x40, 0x42, 0x7, 0xd7, {0x5, 0x25, 0x1, 0x1, "b7"}}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x6, 0x9, 0x2, {0x6, 0x25, 0x1, 0x2, "5a04"}}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0x0, 0x9, 0x7, {0x11, 0x25, 0x1, 0xd, "63e0d2aef1ba9044087d93ee9a"}}}, {{0x9, 0x5, 0x6, 0x1, 0x40, 0x8, 0xab, 0x5, {0xf, 0x25, 0x1, 0xb, "24357be22ace8a114400b6"}}}, {{0x9, 0x5, 0x6, 0x3, 0x10, 0x5, 0x7, 0x3, {0xb, 0x25, 0x1, 0x7, "1e722b33df6063"}}}]}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x201, 0xb, 0x6, 0xb, 0x40, 0x40}, 0xc, &(0x7f00000006c0)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x6, 0x8, 0x3}]}, 0x9, [{0x29, &(0x7f0000000700)=@string={0x29, 0x3, "2da228eaf89cd9800317e0bcfbe01cd72e2daa896fd67ed16701f8ad53a618c6b3f8b66ea2e26c"}}, {0x85, &(0x7f0000000740)=@string={0x85, 0x3, "2169bbe23dcfcfae6287b32018b696f90fad071ac115733f1c1c5fa6cabb2dc5bbc3c1357de86b41b76c946046051a30b49f474ab599a17fedc3e4ea8206f48e69fc952a7ec236a7d669ea903f251d73f5e45b312c0d91aea361f2468d78ba954ebf009d5312cccfb32148f3cbdbf85dfd898f3afe207442d608de2855df1117ced247"}}, {0x20, &(0x7f0000000800)=@string={0x20, 0x3, "0de4fbc516933cd01aecd8b3dd856b25ab3be2626389fe578c26d2de54a1"}}, {0x79, &(0x7f0000000840)=@string={0x79, 0x3, "ac71f0493940d5399c567f50c1b6b5b9e5b9bf6c65c77329ddd7e6327a604f421b68ccf6a04032cfe33764a596de7429ac1b93d76c87e7710e7d3737ed67d984877600daf4671bae64798d5572340023c659b97cd299c01bc9b1f4420fdd8bd1aa3aa16cfaebf5a861a4c9110b34fb2fe23841635e5666"}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x424}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x455}}, {0x81, &(0x7f0000000940)=@string={0x81, 0x3, "7de67e2c7136835db6f141b73e8461d1846fe6f9108d1b3caee862a56da531e16e062720e6cb6e32396e13f6eeaabd9332bf8dec35360ab5334e08a7e6a491117435c8ec019e76205c044fa12b988c84e008e2a142dd8e71dc35a5b7da8d1a0f6f55204c6636000d656947de699cb32d59feb34ee19732a6d7f344bb3f9213"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x400a}}]}) syz_usb_control_io$uac3(r2, &(0x7f0000000bc0)={0x14, &(0x7f0000000b40)={0x40, 0x1, 0x24, {0x24, 0x23, "c2871af182cd43c9a70d25e86b7a87229f6db5469cac5703b86e9033dcb9ff884066"}}, &(0x7f0000000b80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1001}}}, &(0x7f0000000e80)={0x44, &(0x7f0000000c00)={0x40, 0xc, 0x8a, "03839ddd6d2009c08668ecb34b331e46591738eee731c47465d18a027cb25ca738407a976636b82afb31a91817b04bede0831613873f017f99b90804ecc4f2e21728ea3ae25f494865b0084060183510eb62c932c38d11d74113f21d8a4411e64029a08f6fe303239b3de19cf5c7170661538c426c9407f64b7df54f6a684eb060bfd62ff989217f86e2"}, &(0x7f0000000cc0)={0x0, 0xa, 0x1, 0x3b}, &(0x7f0000000d00)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000d40)={0x20, 0x81, 0x1, "8a"}, &(0x7f0000000d80)={0x20, 0x82, 0x3, "9ed852"}, &(0x7f0000000dc0)={0x20, 0x83, 0x1, '6'}, &(0x7f0000000e00)={0x20, 0x84, 0x3, "6fa8c1"}, &(0x7f0000000e40)={0x20, 0x85, 0x3, "0f800d"}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-ioctl$sock_ipv6_tunnel_SIOCDELPRL-openat-copy_file_range-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_RINGS_GET-syz_usb_connect detailed listing: executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000003140)={'sit0\x00', 0x0}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x61) copy_file_range(r1, 0x0, r1, 0x0, 0x1000000001ff, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4080000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0xd, r2, 0x200, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_usb_connect(0x0, 0x24, &(0x7f00000023c0)={{0x12, 0x1, 0x110, 0x68, 0x7a, 0x3d, 0x40, 0x19d2, 0x1255, 0x91, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x8, 0x38, 0x6, "", [{{0x9, 0x4, 0x9, 0x3, 0x0, 0x2, 0x6, 0x0, 0x9}}]}}]}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioprio_set$uid-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$x86-syz_kvm_add_vcpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID-ioctl$KVM_RUN-fsetxattr$system_posix_acl-socket$tipc-recvmmsg-write$uinput_user_dev-openat$uinput-mount$9p_fd-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS-openat$kvm-ioctl$KVM_RUN-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN-mmap detailed listing: executing program 0: ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f0000000300)=[@wrmsr={0x65, 0x20, {0x40000091, 0x3}}], 0x20}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000140)={0x1, 0x0, [{0x40000001, 0x1, 0x5, 0x31237648, 0x80000006, 0x82, 0x4}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r3, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200"], 0x2c, 0x3) r4 = socket$tipc(0x1e, 0x5, 0x0) recvmmsg(r4, &(0x7f0000004b40)=[{{0x0, 0x0, &(0x7f0000007580)=[{&(0x7f00000000c0)=""/46, 0x2e}], 0x1}, 0x7fffffff}], 0x1, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x3a, [0xfffffff8, 0x8, 0x5, 0x10009, 0x8, 0x155f, 0x6, 0x2, 0x25cd, 0x1, 0xb4, 0xa, 0xb2b9, 0x6, 0x8, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x1000, 0x1, 0x8, 0x80d, 0x4, 0x12a0, 0x8000, 0x1, 0x7, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10001, 0x5, 0x91, 0x4, 0x4, 0x16, 0x2, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x2, 0x2, 0x2, 0x2, 0x7, 0x4, 0x7, 0x4, 0x4007f, 0xffffffff, 0x9], [0x9, 0x16e, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0xfffffffe, 0x80a, 0x4, 0xa7, 0x7, 0x0, 0x200b395, 0x400000, 0x80000000, 0x4, 0x19, 0x7, 0x1, 0x3, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x96, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1ce, 0x1, 0x80000004, 0x80000001, 0x6, 0x2, 0x9, 0x95, 0x80000000, 0x4, 0xfffffff9, 0x40000003, 0x1000, 0xfffff804, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x328, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x3fc, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x5, 0x89, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x7ffe, 0x401, 0x3e55, 0x5, 0xd3, 0x8, 0x3437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0x0, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0x3, 0x20008, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x8000007, 0x1e, 0x9, 0x81, 0x3, 0x9d86, 0x9, 0xfffffff7, 0x8, 0x7, 0x5396, 0x939, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xffffffff, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x0, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0xc, 0x463f, 0x4, 0xdab, 0x8003, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f0000000380), 0x14c98, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r10 = dup(r9) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r9, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 29, 16, 8, 19, 30, 15, 37, 7, 30, 20, 4, 16, 10, 3, 30, 14, 10, 7, 6, 30, 8, 14, 21] detailed listing: executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x1, 0x0, @ioapic={0x58000, 0x3, 0xffffff81, 0xfcff, 0x0, [{0x9, 0x0, 0x10, '\x00', 0xf}, {0x8, 0x7f, 0x1, '\x00', 0x1}, {0x0, 0xa0, 0xe, '\x00', 0x8}, {0xa7, 0x5, 0x2, '\x00', 0xe}, {0x6e, 0xf, 0xca, '\x00', 0xc5}, {0x9a, 0x9, 0x1d}, {0x6, 0x6, 0x4, '\x00', 0x8}, {0x0, 0x6, 0x40, '\x00', 0x1}, {0xf9, 0x4, 0x9}, {0x6, 0x8, 0x73, '\x00', 0x5}, {0xfa, 0x9, 0x80, '\x00', 0x4e}, {0x36, 0xf8, 0x9, '\x00', 0x78}, {0x40, 0x1c, 0xf0, '\x00', 0x5}, {0x1, 0x43, 0x2, '\x00', 0x9}, {0xd, 0xe, 0x3}, {0x4e, 0x2, 0x28, '\x00', 0xff}, {0xf, 0x0, 0xe5, '\x00', 0x7}, {0x40, 0x2, 0x4, '\x00', 0xc}, {0x8, 0x4, 0x8, '\x00', 0x4}, {0x6, 0x0, 0x6, '\x00', 0x47}, {0x9, 0x3, 0x8}, {0x2, 0x71, 0x5, '\x00', 0xff}, {0x3, 0x5, 0x9, '\x00', 0x5}, {0x5, 0x64, 0xf5, '\x00', 0x9}]}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x401, 0x0, 0x5, 0x20, 0x3, 0x100000000, 0x106c, 0xff, 0x8000000000000, 0x80000004000080, 0x0, 0x1, 0x0, 0x4, 0x0, 0x8000], 0xfec00000, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000006e80)={0x0, 0x0, &(0x7f0000006e40)={&(0x7f0000006d80)={0x10, 0x464, 0x800, 0x70bd2d, 0x25dfdbfb}, 0x10}, 0x1, 0x0, 0x0, 0x24080}, 0x20000080) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) preadv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/1, 0x1}], 0x1, 0xffffffff, 0x66e) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) splice(r3, 0x0, r4, 0x0, 0x725e65a6, 0x0) (async) splice(r3, 0x0, r4, 0x0, 0x725e65a6, 0x0) write$binfmt_elf64(r3, &(0x7f0000000180)=ANY=[@ANYRES32=r4, @ANYRESOCT=r4], 0xfffffd88) (async) write$binfmt_elf64(r3, &(0x7f0000000180)=ANY=[@ANYRES32=r4, @ANYRESOCT=r4], 0xfffffd88) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat$sndtimer(0xffffffffffffff9c, 0x0, 0x2000) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240), 0x200, 0x0) read$snapshot(r5, &(0x7f0000000380)=""/140, 0x8c) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) syz_usb_connect(0x2, 0x44, &(0x7f0000000800)=ANY=[@ANYBLOB="1201000038b51140866b11c2ca2501020301090232000104000002090479030208066249090506004000fd20080725018001060009050e10"], 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (async) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="48b8a5f8c0551b1936450f23d80f21f835400000600f23f848b800000000000000800f23c00f21f83503000e000f23f866baf80cb0f52881ef66bafc0cedf3470f09660feea806000000460f01c00f01dfc42261bf000f01c2b9e20a0000b800200000ba000000000f30", 0x6a}], 0x1, 0x79, 0x0, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af24, &(0x7f0000000100)={0x1}) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000300)={0xc9, 0x0, 0xc}) ioctl$KVM_RUN(r2, 0xae80, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_SEND(0xffffffffffffffff, 0x40489426, &(0x7f0000000080)={{r2}, 0x0, 0x0, 0x0, 0x7, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x142ba3) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/address_bits', 0xb883, 0xb2) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000280)={r2, 0x0, {0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf, 0x14, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f9858c1a7bedabd69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30d50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc20d81a8ca55ba139c01802c4dae4162e43acff03ad02", [0x7fffffffffffffff, 0x7]}}) write$tun(r2, &(0x7f00000004c0)=ANY=[], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x9, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) executing program 2: syz_genetlink_get_family_id$ethtool(&(0x7f0000000a40), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000240)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x6049, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x50, 0x2, "", [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x1, 0x0, 0x76, {0x9, 0x21, 0x40, 0x12, 0x1, {0x22, 0xf12}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x5, 0xd4}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x9, 0x9, 0x8}}]}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000280)={0xa, 0x6, 0x300, 0x30, 0x7, 0x80, 0x40, 0x1}, 0x26, &(0x7f00000002c0)={0x5, 0xf, 0x26, 0x3, [@ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "16d71731861d197fadad4b651c1a9437"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0x6, 0x49, 0x2}]}, 0x6, [{0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0xc0a}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x439}}, {0xd7, &(0x7f0000000440)=@string={0xd7, 0x3, "2968659d8e3589155bd2dde457fb776998292696ea903886416162e7b89f279e8c714d5d0f3647a5f772155eaa5fe3beee865af9c54867e1430f2d387801caa4c44e48eec3b83ca8d8d2fe930abff10823b2ef0efb848d746c936d0a991ec5b69e10c47de2193d62b2f8edba639ddb2e6011d5cf5c4f40db14a64c44eaa15a0a4bab1314fbc3d30abcef2e5d2fcaf665c437c357263a50e8e34a252d78c8f5b0e9ace1b2dbdb4e23d0c48236c06539225fb6e27b4961f3e72af99f87d9d2bbc6ef8507ae288297e6019fb53449ed1ecd67a5ace468"}}, {0x4b, &(0x7f0000000540)=@string={0x4b, 0x3, "5e5dbaf0b242fd33f82ce27c024b228a24462eb837f81dd534b0a7672f823f715c36a9b7e18efcbae8ea8b571d9eb34206f96d864339b39de0000a957fc0c0db7c019301e7a3bb5995"}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4}}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x860}}]}) (async) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) r1 = socket(0x10, 0x803, 0x0) splice(r1, 0x0, r0, &(0x7f0000000040)=0x4, 0x100000001, 0x2) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x400c008}, 0x8090) (async) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'veth0_virt_wifi\x00', 0x0}) (rerun: 32) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000100)={r3, 0x2, 0x6}, 0x10) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x89a1, &(0x7f0000000040)={'syzkaller0\x00'}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c616c6c6f775f6f746865722c001d3d3d4e9cdf3c7943a9c559f06ebf1baed22787aead92a88a5d5ea3269108811497c214474a9b094b569d62ee0fdd206d5d20f2f6086c71e613bd420c423324a1249eaea1dda45e08db684a7b41b4820e5098e9a2f72c079fe255d364c7ee3bb3782d531cefff9f3b37602ed26aadb2df48da9116a338bb692b30376041a6dda12a284e1ffc18cdc3c101968a44e530e79bcec494cc8cd8e19861f1aeaaec323643b1f166524a643839d22c9514ec5c708b136f591972"]) (async) r6 = socket$netlink(0x10, 0x3, 0x4) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000c0c100000000000224e0000", 0x58}], 0x1) (async, rerun: 64) lstat(&(0x7f0000000000)='./file0\x00', 0x0) (rerun: 64) executing program 2: pipe2$9p(&(0x7f0000000400), 0x0) (async) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="bc000000190001000000000010000000fe8000000000000000000000000000bbfe8000000000000000000000000000246e22000bffff00200a0080a037000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000f7ffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000056ff00000000000009000000000000008000000000000000000000000000000000000000b66b6e00020000000000000004000500"], 0xbc}, 0x1, 0x0, 0x0, 0x810}, 0x80c4) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000080)='syz1\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440100000102010100000000000000000100000a0c000280060003400000000008000440000000070a000b00512e393331000000340001801400018008000100640101000800020064010100060003400004000006000340000100000c000280050001002f000000080008400000000388000a80640002800c00028005000100880000000c00028005000100fe80000000000000000000000000003c14000400fe80000000000000000000000000002706000340000300001400018008000100ac1414bb08000200ac1e010108000140000000001800028014000180080001000000000008000200000000000600074000000000440003802c00018014000300fe8000000000000000000000000000bb14000400fe80000000000000000000000000003306000340000200000c0002800500"], 0x144}, 0x1, 0x0, 0x0, 0x40080c4}, 0x40090) (async) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) (async, rerun: 32) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (rerun: 32) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, 0x0}], 0xaaaaaaaaaaaab66, 0x11, 0x0, 0x61) (async, rerun: 32) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) (rerun: 32) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async, rerun: 32) r5 = socket$unix(0x1, 0x1, 0x0) (async, rerun: 32) r6 = socket$unix(0x1, 0x1, 0x0) bind$unix(r6, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r6, 0x0) (async, rerun: 64) connect$unix(r5, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async, rerun: 64) r7 = socket$unix(0x1, 0x1, 0x0) connect$unix(r7, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) close_range(r6, 0xffffffffffffffff, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x100) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={&(0x7f0000000100), 0xc, &(0x7f0000000380)={&(0x7f0000000200)=ANY=[@ANYBLOB="f00000001000000127bd7000fddbdf250a01010200000000000000000009555a6c14142a0000000000000000000000004e2400094e2400080200002016000000", @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="ac1414aa000000000000000000000000000004d46c0000000a0101010000000000000000000000000d000000000000000200000000000000ff000000000000000301000000000000000001000000000003000000000000000500000000000000ff03000000000000faffffffffffffff0300000000000000010000000000000004000000000000000600000005000000060000002bbd700000000000020001054100000000000000"], 0xf0}, 0x1, 0x0, 0x0, 0x10}, 0x4) (async) r9 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$vga_arbiter(r9, &(0x7f0000000000)=ANY=[@ANYBLOB="64653eb832d4910f34b86e6500"], 0xd) (async) socket$netlink(0x10, 0x3, 0x0) executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) listen(r1, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNSETCARRIER(r3, 0x400454e2, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r4, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000000)='reno', 0x4) recvfrom(r4, &(0x7f0000000480)=""/110, 0x168f6f3d, 0x734, 0x0, 0xfffffffffffffecb) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000400)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000000380)="dcb1ff1fdb909b826a513d90e44b7c48e37a0a7de5985ef7f4bc8b10fed694620f4232bd5574f4e5590f1abd397b979a7d6a33b8683df0ca3cf057068616f7235c225e7a28c42a34afb098b66ef2f99390d00bc93881ac764d825766cccecac3abda3de897acd044e43373c0d6617ff5c3e526a137edf72eb0e82227df62", 0x7e, r2}, 0x68) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffc000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x3000)=nil) (async) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x3000)=nil) brk(0x200000ffc000) (async) brk(0x200000ffc000) r1 = epoll_create1(0x80000) epoll_pwait2(r1, &(0x7f0000000040)=[{}], 0x1, &(0x7f0000000140), &(0x7f00000001c0)={[0xc]}, 0x8) r2 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') syz_usb_connect$midi(0x0, 0xca, &(0x7f0000000400)=ANY=[@ANYBLOB="120110010000004030144b474000010203010902b80001010600080904000007010300010905071a400003090414250110b41c10ebbbe4e1460bde1e498aba8ae809050e0020000360091d25010ca980056ead29da65343c5d5f0905090300040406ce1325010f57d49c000e088542c6ace0b544c03c09050603103f0206060d2501098ab7b20ca96ea708b609050d0820000708081225010e253e15b96c94ee0ac854c2b9125b090506104000040eff052501019609050c1020009500100c2501082b1152cc0eb301d4"], &(0x7f0000000640)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x0, 0x1, 0x0, 0x9, 0x10, 0xf7}, 0x1c, &(0x7f00000001c0)={0x5, 0xf, 0x1c, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x2, "3be7d1cd0b30f5497df2dbc0d4687678"}, @ptm_cap={0x3}]}, 0x4, [{0x1b, &(0x7f0000000240)=@string={0x1b, 0x3, "5bbdfbf7f178534f02ff9e3bb696b5a1f3547b3b4f2bab0232"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0xf0ff}}, {0x92, &(0x7f0000000580)=ANY=[@ANYBLOB="9203e7443e206bd6db3dbabaa90ac4d325015d273fb7dc83fc5b18b8b66a67c60e00000000000000b8a1a760018a516e9883d15d35ddc4ea158e13bcc39e5d39b8ab21deda7e2ebbcaa764103dd1c4bada8def457528322e3f5d8c589a5da2586d9042f02440aa42003024647d36cebbc6e2c998639f52958ef1ae1b697cf8455b4fa6f1f9063b236bf922ad76cbab22d1e0"]}, {0x29, &(0x7f0000000500)=@string={0x29, 0x3, "c1b147a6d9952e7e94ff9362e240a540528d75c4ce5ee2f58e7141e795132fecffe102c298c4f8"}}]}) openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) open$dir(&(0x7f00000006c0)='./file0\x00', 0x4000, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="580100001000130426bd700040000000ac1414bb000000000000000000000000ac1e01010000000000000000000000004e2000074e1f00000a00202067000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141422000000000000000000000000000004d43200000000000000000000000000ffffe000000100080000000000007d0100000000000000000000000000000400000000004000ffffffffffffffff06000000000000007f0000000000000002000000000000000000000000000000fd2100000000000004000000000000000400000000000000f6004000040000000800000000000000ff340000020001be330000000000000067001200726663343330392863636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d800000040"], 0x158}, 0x1, 0x0, 0x0, 0x4000}, 0x4000804) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) openat2$dir(0xffffff9c, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f0000000140)={0x40, 0x110, 0x2}, 0x18) (async) r4 = openat2$dir(0xffffff9c, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f0000000140)={0x40, 0x110, 0x2}, 0x18) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)=ANY=[]) (async) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)=ANY=[]) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000d00)={0x2c, &(0x7f0000000bc0)={0x20, 0x23, 0x2, {0x2, 0xa}}, 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000d00)={0x2c, &(0x7f0000000bc0)={0x20, 0x23, 0x2, {0x2, 0xa}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r5 = ioctl$USERFAULTFD_IOC_NEW(0xffffffffffffffff, 0xaa00) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000700)={{&(0x7f0000629000/0x1000)=nil, 0x1000}}) (async) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000700)={{&(0x7f0000629000/0x1000)=nil, 0x1000}}) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f0000000540)={0x14, 0x0, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r8, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x400000f4, 0x0, 0x4}]}) (async) ioctl$KVM_GET_MSRS_cpu(r8, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x400000f4, 0x0, 0x4}]}) syz_usb_ep_write(r0, 0x81, 0xffffff75, &(0x7f00000002c0)="b9425b44651dd23241963599000000110000004a16941ff5f4b4f1f0add7fcf2b877fceafffffffffff1ffdf4cd9f5d3969890522c77157d88010000003a5bd5531d459dffff03000000000091ff000000e8f5b3371da3635b8b4fa637135800001f65e4b436aa9e50bc0f19b7d3372ff9ebcede1fb5e9428f54d5d1f0cc752cf246a5d2da34a5aa97dc14a469c3dd3e26b41c356484e46fd66e3f2c7807e8773eed7b94fa099ab84feadec2ea95f65bba452eae5b0900f98a979a88c517a2dc360a00237723e2f467af706ea17226296b3a10a351cb47aba2c6b836c90679b4dd859ddc9e4800448aab0000000000000d75f34bb50d8d7084") executing program 3: openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080), 0x2642, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = accept(r0, &(0x7f00000000c0)=@ethernet, &(0x7f0000000040)=0x80) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0xd, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_usb_connect$uac1(0x2, 0xdc, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r3, @ANYRES16=r2], 0x0) executing program 0: unshare(0x64000400) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = dup(0xffffffffffffffff) unshare(0x24020400) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) (async) r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0), 0x2) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r6, 0x0) (async) ioctl$UDMABUF_CREATE_LIST(r5, 0x40087543, 0x0) (async) inotify_init1(0x0) (async) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0x6, 0x1, 0x0, 0x5, 0x81, 0xfff9}, 0x20) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000340)={0x400000100002f, {0x0, 0x0, 0x0, 0x6}}) (async) r10 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000180), 0xe1742, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000880)={'syz1\x00', {0x4, 0x9, 0xe, 0x2}, 0x2b, [0x6, 0x8, 0x1, 0x2, 0x10001, 0x5, 0x3ff, 0x6, 0xe, 0xa93, 0x5, 0x7, 0x1ff, 0x5ce1, 0x3, 0x100, 0x267, 0x212, 0x8, 0x3, 0x4, 0x3ff, 0x1, 0x1000, 0x3ff, 0x8, 0x4, 0x0, 0x6, 0x200, 0x10000, 0x2e, 0x9, 0x800, 0x2000000, 0x0, 0x0, 0x3, 0x2, 0x6, 0xfffffffe, 0x1, 0x80000001, 0x5, 0x5, 0x1, 0x400, 0x1, 0xfbf2, 0x0, 0x5, 0x2, 0x77, 0x9, 0x100, 0x16a, 0x2, 0x8, 0xb6a, 0x0, 0x1ff, 0xe, 0x80, 0x2542], [0x1, 0x8, 0x157, 0x7, 0xe3, 0x160000, 0x4, 0x9, 0x4, 0x3, 0x1, 0x5, 0xa00000, 0x4, 0xffff0000, 0x10001, 0x63b, 0x10, 0x8, 0x9, 0x400, 0x7, 0x0, 0x4, 0x8, 0x7, 0x3, 0x5, 0x80000000, 0x1, 0x6, 0xffffffa7, 0xe0000000, 0x7c, 0x7, 0xfffffffe, 0x8079, 0x6, 0x9, 0x8, 0x1000, 0x4, 0x6, 0x1, 0xa, 0x1, 0x5, 0x3, 0xd4b, 0xdfa, 0xa, 0x5, 0x9, 0x5, 0x1, 0x9e, 0x4, 0x4, 0x0, 0x8, 0x80000001, 0xffffffff, 0x84a, 0x5], [0x407, 0x7, 0x0, 0x5, 0x5, 0x1df, 0x8, 0x6, 0x45c00000, 0xfffffff9, 0x0, 0x4, 0x8, 0x62, 0x0, 0x1, 0x3, 0xf87, 0x3, 0x0, 0x400, 0x10, 0x7, 0x4, 0x61c8, 0x5, 0x1c0, 0x9, 0x3, 0x4, 0xf, 0x80, 0x2, 0x1, 0xb4a2, 0x92bc, 0x5, 0x4, 0x3, 0x1, 0xe, 0x9, 0x9, 0x590, 0x9d5c, 0x81, 0x0, 0x1, 0x9, 0x9, 0x0, 0x6, 0x2, 0x7ff, 0x81, 0x7, 0x7, 0x9, 0x8001, 0x18, 0x1, 0x93e, 0x401, 0x810], [0x100, 0x3, 0xfffffffa, 0x0, 0x6, 0x8, 0x3ff, 0x4, 0x9, 0x5, 0x7, 0x1, 0x0, 0x8, 0x4, 0x6, 0x400, 0x4, 0x2, 0x1000, 0xbfc, 0x2, 0x8, 0x7fffffff, 0x800, 0x8000, 0x12, 0xffff9268, 0x1ba, 0x5, 0x3, 0xffff, 0x400, 0x400, 0x1af4, 0x7bb1, 0xb3d, 0xfffffffd, 0x7fff, 0x0, 0x80000000, 0xce, 0x198, 0x1, 0xffffff9a, 0x4, 0xf14, 0x9, 0x7ff, 0x7, 0x886, 0x1, 0x7, 0x7, 0x1000, 0x0, 0x2, 0x5, 0x20000000, 0xa3f5, 0x36, 0x7fff, 0xd3cf, 0x5]}, 0x45c) (async) write(r10, &(0x7f0000000000)="88de80841d87", 0x6) (async) close_range(r8, 0xffffffffffffffff, 0x0) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0xf78, 0x2, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x2, 0x9, 0x5, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x4, 0xb, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xe, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xe, 0x0, 0x71, 0x2, 0x6, 0x789, 0x50, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x401, 0x12f, 0x6, 0x10, 0x9, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x5, 0xffe, 0xfffffffc, 0x62b, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0xfffffff8, 0x9, 0x402, 0x401, 0x6, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0xbcf5, 0x1, 0x2, 0x2, 0x9, 0x3000000, 0x9, 0x0, 0x9, 0x6, 0xb, 0xff, 0x1, 0x9, 0x4fbd, 0x2, 0x7f, 0x9, 0x8, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x2c, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x4, 0x5, 0x1005, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xfffffff6, 0x7, 0x7, 0xfffffff9, 0x6, 0xb8d, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x5, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x6, 0x1, 0x0, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0xfd, 0x10000, 0x7, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x8, 0xc8, 0x4, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9600, 0x5, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) (async) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0x80000000, 0x10301) ioctl$HIDIOCGCOLLECTIONINFO(r1, 0xc0104811, &(0x7f0000000200)={0xaa5f, 0x2, 0x1, 0x1}) r2 = socket(0x11, 0x3, 0x4000000) r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0x40000000200, 0x101301) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffff8, 0x40, &(0x7f0000000080)={0x4b5a9da54893e123, 0x3, 0x10, 0xfffd}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x20004, 0x0}) r4 = socket$inet6(0xa, 0x1, 0x0) r5 = dup2(r4, r4) ioctl$sock_inet6_SIOCDELRT(r5, 0x890c, &(0x7f00000000c0)={@remote, @private0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40003, 0x40, 0x5, 0x100, 0x0, 0x590029}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000880)={'ip6gretap0\x00', 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r8, 0x5452, &(0x7f0000000040)=0xcd8) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) syz_usb_connect(0x0, 0x5d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a"], 0x0) close(r7) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f0000000080)={'HL\x00'}, &(0x7f00000000c0)=0x1e) bind$packet(r2, &(0x7f0000000540)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000000)=0xe9, 0x4) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000100)={'ah\x00'}, &(0x7f0000000140)=0x1e) sendmsg$netlink(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="3f011400e0dc14"], 0xdd12}], 0x1, 0x0, 0x0, 0x4000054}, 0x0) executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_selinux(r0, &(0x7f0000000080), 0x0, 0xfe, 0x2) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) mount$cgroup(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x2010400, &(0x7f00000001c0)={[{@name={'name', 0x3d, '\x00\x00\x00\x00\x00'}}]}) executing program 0: r0 = userfaultfd(0x801) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x2, @mcast2}, 0x1c) r2 = socket(0x1a, 0x4, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6c0000001900010000000000fbdbdf251d010900500012804900f880e02b4221d3c744305f542a963097bf883548fe5ae164e5e6f4e0fb772aa1dc9e0330c9c8d1a98a1e02167abc021907e655c6053ebde9f7c472a700000008000e007f00000100"/108], 0x6c}, 0x1, 0x0, 0x0, 0x5}, 0x0) mmap(&(0x7f0000bc1000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x2ec37000) r3 = socket$inet(0x2, 0x4, 0x1) bind$pptp(r2, &(0x7f0000000040)={0x18, 0x2, {0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x1e) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x8, 0x32, 0xffffffffffffffff, 0x6931b000) write(r3, &(0x7f0000000080)="08008edf773c8000", 0xfd) r4 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000201c1b091c00000000000109022d0001000060000904008002030000000921080400012205000905810320000908070905020340"], 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_ep_read(r4, 0x2, 0x0, 0x0) r5 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0xa, r5, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000000)='ix:\x88\xfe\xf7\x01') ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) executing program 1: syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0x7fffffffffffffff]}, 0x8, 0x80000) (async) io_setup(0x2, &(0x7f0000000200)=0x0) io_submit(r1, 0x47f, &(0x7f00000005c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f00000003c0)="951aa14bd6f68579cac67c83bf8d4500e5cea1bb1596d4ee6645fa16fa7cacb9214070a622a2c57b89075f59b85c7b5b2c41edc9d2cd5a2c95ed1c2cf72425be9c1a2df1b60a309bc3228d7e85b300f0d7a042a40166b9208e9d2e423c32ad8e47adedf5dc425c6bcb031fb2230835d41afc23476eae602bad3246417e5ac757", 0x80}]) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000005) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f00000001c0)=0x7) (async, rerun: 32) write$FUSE_INIT(0xffffffffffffffff, &(0x7f00000002c0)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x0, 0x5f8f4c58, 0x1, 0x101, 0x7, 0xa15, 0x0, 0x0, 0x20, 0x2}}, 0x50) (rerun: 32) shutdown(r0, 0x0) syz_usb_connect$uac2(0x3, 0xa8, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x30df, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x96, 0x3, 0x1, 0x0, 0x30, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x3, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x26, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x1, [0x0, 0x0, 0x3, 0x2, 0x1, 0x0]}, @output_terminal={0xc, 0x24, 0x3, 0x2, 0x302, 0x1, 0x3, 0xd, 0x7, 0x80}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@as_header={0x10, 0x24, 0x1, 0x8, 0xd7, 0x3, 0x3, 0x0, 0x75cd, 0x6}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x33, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x4, [{0xd3, &(0x7f00000000c0)=@string={0xd3, 0x3, "20bfe43509b09be426727e8f039aaf14093dba3dff3951ea8674c098f07d46f23529800a27df74fd00af36bc02145c76a2bec1a5956f8df6b0ab4e1b497a0f7367d3b456f3c78bf73f155a80e7b836c6279a88f5d2058c77ea67c2a56ec8f23aa3fdf77b77fa29e0378a9bf9a39eaf50a6d5e69fbedc76874ddee42800b94d89d54ce01824e9b9803ecd584b39dbf8697a4b7cf4c67817112020f71cb041c2ebc9c9293e20dc45dcabb2345e3c7d8794f543578ecc3cdd819449970cb21136da04b364f7f6792ce7cae0e72a9ca2ba1bba"}}, {0x45, &(0x7f0000000300)=@string={0x45, 0x3, "b1823ae370c773fc8b6707999fadf27e62813c0d45fe3eef29f14766f68a0ca3de0318175d3fb50fef4e1331950a926c979f749c65588da411709f69b84f34ffc55873"}}, {0x9c, &(0x7f0000000480)=ANY=[@ANYBLOB="9c039d3bfe0084b16fbcbf4c73895a18ce821f32c9cb437e50a1ef26daaa372b51bf61a5504596c115f5d46eda4878ccd00a08af209a29e49930d8f5385edf2de7094ae2d2f746d7594184279807d2ba47f639d8ccf4d7717f5eed18bc46595b5ae63b94c7e46c5846571c143aeb27f79fa23a70a192425de334c7fbf29f9e1754e072526a2ec4116327fb3032d81e1f6f36b12768551189387609be"]}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x1401}}]}) (async) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r0, 0x4068aea3, &(0x7f0000000540)={0xdf, 0x0, 0x6000}) executing program 0: ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000b40)={{0xffffffffffffffff, &(0x7f0000000040)='\x00', 0x800c2, &(0x7f0000000080)={@_ha_fsid={[0x5, 0xebc]}, {0x46, 0xb, 0x6, 0x19c4}}, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x8}, 0xc, &(0x7f0000000dc0)=[{0x3, 0x7fff, &(0x7f0000000140)='$\x00', &(0x7f0000000180)="e2e5131823f1ba94a4d043d073e2af6abd1ccfae25cf520038bca9fda21c24b98592f1b7f3de35dc5f9476ad4f8161039897ab390c59d36fa1310f48db0b1f13bb993b8c410a27a34b3d64a9dbb17347eabc05eeccc562de3087763f3ec032e8b89b88a8842429247fe312eed1c51da77aa36de7b77e8068d398449e44b5d39938eb8ad5493bb6f06375e718", 0x8c, 0x20}, {0x3, 0x0, &(0x7f0000000240)='\x00', &(0x7f0000000280)="0a0e7c8757b055ce285f9461f2f6278a675020eaaeb6ab20964faa0d6a9a66e2db8c59df62aed6c6ab6d3969c220d06c69f3a50ab0f69173ee7feb950c18aa9177f9e85f7cb2d31308e3908c35e31ec00a5ec39f8b5bd2525ef1c94f79", 0x5d, 0x4}, {0x2, 0xfffffff0, &(0x7f0000000300)=')\xce,+\x00', &(0x7f0000000340)="59c1de541398f85df8b02d98ae0652d581ad6f9549c765eec43a539cb330cdc78ffdb11f19339b92f64adee30487526979f0ce7d3443c4778d6844d30df3355e89999fb9cf0c16d4732d1b58da7511c4132c63e3298869ea63c1c6711c581385e4adf53f2a745c861d7d508f399f2376198288611c622cb01ce526ec005084624193951b4448cafa82b7da28ae46d0f9b1f8ab2543299570446bafb3274f7f4a2172", 0xa2, 0x2}, {0x0, 0x5f9d, &(0x7f0000000400)='-\x00', &(0x7f0000000440)="79c815307b20c1baa989e3a26092f32134633897dcc3529e8945cdc3f4ab95da3ae3f18c0253ee11b1ced76f82ceaf66678e1153e456cb9fc8cca313bc82667789b80583baebc9ca6c79d802ab95206350263b574faec069679d629a849e72c625f330354a5bbb9a7b57e002b762fa1b3bd529b8691f99c7", 0x78, 0x22}, {0x3, 0x8, &(0x7f00000004c0)='\r\xde\x00', &(0x7f0000000500)="56bc887d32e6277466d802d8182de9ccb1f6d4e17c48203f205ae7caa895e7e7458ceb6481b5598d1e819f817b2f962c3e229ca9a337d8bf316450aa2c35d5897d512133158f5d61e8619fee84912b9ab147adecaeb99a69eb93c615214467c8ecfd23a7e8a29d544c3ba1687553d76da85ecd0fbc2fdb68dc3dfd48c5ac6f4e7f54437dae2e94106b4b43c143205dad05cd2473497abe3ace45e3832add5562d2b986252eee45b5129c7cee4b39a62b22ab05c2934911e4c321c8a38b5733be118488f83d080ee23cbb476ffa4038624ffddf4c58b17aaab57f6619691cc5f93ef66b5d8ab5580d0525a2ce75fd1a27341e0a08", 0xf4, 0x20}, {0x1, 0xfffffff1, &(0x7f0000000600)=':^{$\'/\'$Y{\'&,.+^\x00', &(0x7f0000000640)="2309f2ebf41f64aa73656021319f1c923e588509b6cf75424c5e380789bd79bac2d7b0b298be8e7ddbd017d7117b60da08ebda9b05f15c081771802d0520ede386dbc5df8ed660cec5c0f9c0d9150155dd8e82ab063f046ac49d0e7831e56e391a9214baf41909d349f7bae48ee66dedf6", 0x71, 0x38}, {0x2, 0x4, &(0x7f00000006c0)='(%\x00', &(0x7f0000000700)="faf39ce8654501bca2b4e41aeb5e3c721ad3980ac299c97d3013f18ae233ec5e9b4282b9077bce94d0ad79390cf01ce71e5809f99914c6e6cb47da8c6e8d2097a53981b02076385fb8ac55174e7d81693ea5273b02ea28774fe3eff2f3a14f8a8543603a104814323964b22034eb7c579d943dab4f59941f5d17adb14b6432dd6b2d4c8b2dd3f9f2183cc0cc175352ac32a91dbf9d17aa2631cbca901e2efd2351bc9aefde9c64708551bc4d5ff7509bbbc2d2946f83ed37e9f37cf23686923e6f830756f475ba14826a6e643198984666a587bab78190bd56", 0xd9, 0x38}, {0x2, 0xfffffffc, &(0x7f0000000800)='[-.](^#*{**\x00', &(0x7f0000000840)="a8be5e94db2b1f46cf4b54863b04a06dbba37ec5ad975ddda04e57d3a72852a62f849a4655334040e892d00a6dd57f72e3b86ddd0c0853354ae340a4931f5d60bd258614227c3a4d78752e3048a46d4b050aeb5cc957d6415328a4c23cd58df8817c4063b3a86981c83d671fc3482a", 0x6f, 0x1}, {0x3, 0xd, &(0x7f00000008c0), &(0x7f0000000900)="9e807704f391864ca5bab6830b3830104888b9f5c66b438b8d8ee26a2c6f477863cb021cf597aa7a726a36bf03617875f34a14d96587e8cb8f96d0b42b85be2b907087f6d209b5c3003c5b4f4c90a789bbaf64740ca520980db6efded2d9ec8ea7bb99901d551ebd66d76dcd523a007a24d0442a5b1738372bb53dc4c97ca67ae768d4d9fe45adf3aac42eeea8c351734ed044281918420f6ac9ea0e5bb138e193f9e70df632380116c2903bb90b51b43975dc59af44b1c9f17998596dd7555642520a0fd7fec85a90f15cd07b90bd91d6bb45b87d8b67b9137b90cce6488da56444256b1201a1decf2df2", 0xeb, 0x12}, {0x1, 0xb, &(0x7f00000008c0)='\x00', &(0x7f0000000c00)="4e986a21909dec2f", 0x8, 0xa}, {0x1, 0x400, &(0x7f0000000c40)=')\xce,+\x00', &(0x7f0000000c80)="ae04a3c64406f2a147b5e3e3e87de6d4a27ec9a81bad289dd446e22e3a7fa1082b97685714d4f95e626df805078a9a94ab", 0x31, 0x8}, {0x3, 0x5, &(0x7f0000000cc0)='-\x00', &(0x7f0000000d00)="68c34e832a6f04603168f99130893d60918156fdbe81cb6819345f0e789a4ee883e9c1bc0f0fbdee89c70e25ba336b0a4ff63044606f50932203022fd1ecaf8ef2b4ed37716514b7eb17e68b20bc305ca30f60058fd92598bcf5021503d211a2beb3e94c70650e3b3cc122c6b969d4490721d321f9b121dc6c3d0857e21d1a86ca0dc34c7b17ff32eaf8a5da56abf585d216b83cea1c5acf7627d62164", 0x9d, 0xa}]}) ioctl$BLKSSZGET(r0, 0x1268, &(0x7f0000000bc0)) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x1, 0xf0, 0xc9, "", [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x1, 0x3, 0x6, {0x9, 0x21, 0xfffc, 0x77, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x5, 0x48}}}}}]}}]}}, 0x0) executing program 3: ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f0000000300)=[@wrmsr={0x65, 0x20, {0x40000091, 0x3}}], 0x20}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000140)={0x1, 0x0, [{0x40000001, 0x1, 0x5, 0x31237648, 0x80000006, 0x82, 0x4}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r3, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200"], 0x2c, 0x3) r4 = socket$tipc(0x1e, 0x5, 0x0) recvmmsg(r4, &(0x7f0000004b40)=[{{0x0, 0x0, &(0x7f0000007580)=[{&(0x7f00000000c0)=""/46, 0x2e}], 0x1}, 0x7fffffff}], 0x1, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x3a, [0xfffffff8, 0x8, 0x5, 0x10009, 0x8, 0x155f, 0x6, 0x2, 0x25cd, 0x1, 0xb4, 0xa, 0xb2b9, 0x6, 0x8, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x1000, 0x1, 0x8, 0x80d, 0x4, 0x12a0, 0x8000, 0x1, 0x7, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10001, 0x5, 0x91, 0x4, 0x4, 0x16, 0x2, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x2, 0x2, 0x2, 0x2, 0x7, 0x4, 0x7, 0x4, 0x4007f, 0xffffffff, 0x9], [0x9, 0x16e, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0xfffffffe, 0x80a, 0x4, 0xa7, 0x7, 0x0, 0x200b395, 0x400000, 0x80000000, 0x4, 0x19, 0x7, 0x1, 0x3, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x96, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1ce, 0x1, 0x80000004, 0x80000001, 0x6, 0x2, 0x9, 0x95, 0x80000000, 0x4, 0xfffffff9, 0x40000003, 0x1000, 0xfffff804, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x328, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x3fc, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x5, 0x89, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x7ffe, 0x401, 0x3e55, 0x5, 0xd3, 0x8, 0x3437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0x0, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0x3, 0x20008, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x8000007, 0x1e, 0x9, 0x81, 0x3, 0x9d86, 0x9, 0xfffffff7, 0x8, 0x7, 0x5396, 0x939, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xffffffff, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x0, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0xc, 0x463f, 0x4, 0xdab, 0x8003, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f0000000380), 0x14c98, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r10 = dup(r9) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r9, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae03, 0x28) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x7, 0x8dc, 0xffffffbf, {}, {r1, r2/1000+10000}, {0x2, 0x1, 0x1}, 0x1, @can={{0x3ff, 0x1, 0x1}, 0x8, 0x0, 0x0, 0x0, "2064e7609a783858"}}, 0x48}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000b80)={0x14, 0x0, 0x2, 0x303, 0x0, 0x0, {0x5, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r3 = socket(0x10, 0x803, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000020000000800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x40) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x44800) sendmsg$NFQNL_MSG_CONFIG(r5, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000080)=ANY=[@ANYBLOB="30000000020301"], 0x30}, 0x1, 0x0, 0x0, 0x40840}, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f00000001c0)=""/17, 0x11}, {&(0x7f00000007c0)=""/141, 0x8d}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f0000000000)=""/39, 0x27}, {&(0x7f0000000040)=""/98, 0x62}], 0xa, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x2000, &(0x7f0000003700)={0x0, 0x3938700}) executing program 1: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') syz_pidfd_open(0x0, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x10000000) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000003140)={'sit0\x00', 0x0}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x61) copy_file_range(r1, 0x0, r1, 0x0, 0x1000000001ff, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4080000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0xd, r2, 0x200, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_usb_connect(0x0, 0x24, &(0x7f00000023c0)={{0x12, 0x1, 0x110, 0x68, 0x7a, 0x3d, 0x40, 0x19d2, 0x1255, 0x91, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x8, 0x38, 0x6, "", [{{0x9, 0x4, 0x9, 0x3, 0x0, 0x2, 0x6, 0x0, 0x9}}]}}]}}, 0x0) executing program 1: r0 = socket(0x6, 0x0, 0x3e) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000080)=0x5, 0x4) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32, @ANYBLOB="08004e01"], 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x4) (async) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd85d82, 0x0) executing program 1: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xd965, 0x800, &(0x7f0000000180)={0xc9, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) recvmmsg(r5, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/160, 0xa0}], 0x1}, 0x1}], 0x1, 0x2, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x10000000) (async) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000023c0)={0x0, 'vlan1\x00', {0xffe}, 0x6}) executing program 0: r0 = syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000020000402505a1a440000002030109025c0002010000000904000001020d0000052406000105241000000d240f0100000000060000010006241a0000000905810300020000000904010000020d00000904010102020d0000090582020002000000090503f53f39d33169b12395de019d9d8d07520c20664f05a7982976374e688c67f7f17c9dd09247bdb7fbcd84905d1bca7d24a81ebed7367b96c7f3d16eb5a8c6e2d2dbdafb00084b5b7618ad60c1918ce5a37e45fcbf660fb2916303b10dd6aeb6bc1731e8a1c757401e704723aac18830f01f278a797bf6eccb5ee5441341b3883dd3afd9d165a55220cfe0a2918efdc52e024eb9e3e44ef6bae1a0f47ad9c2d515298951651821c808159fbf09605617e11040a73626a3faa0ebdf2e5aed7dd8693b041b7299b5c6c1e5b33957b1c933748a"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) mkdir(&(0x7f0000000840)='./file0\x00', 0x145) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) setresgid(0x0, 0x0, 0xee01) utimes(&(0x7f0000000200)='./file0\x00', 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000080)={0x14, &(0x7f0000000040)={0x20, 0x34, 0xf, {0xf, 0x7, "c5984a926bc1433e2ed91f1d86"}}, &(0x7f0000000140)={0x0, 0x3, 0xf3, @string={0xf3, 0x3, "7bbc05a293951190558746304432ff5b195ce85e635b4b917859b61bf6fe0e2d82d2086f10acdea5a3bda37f7d39e933852367994b6e48f8344cfd9c589199ab1eea504469cbd204216e258fbd345289580ab8860cfac3c123099f845b13b76aafb271c860ecf818f9766a3a5f6449dd5852cd5995fc1a25cd5dd18a50dc553036c58662bb480f1184b3d7e847330b6f1e0a6f8f52b507b1243815562cad3c858d704bf4ae81010c8001babdb6ec5e5e54f4bb6bebe13cc04bb1774c8a85e3ea0379cca08493614541b2a867f1958a77d7afc9e53105e5aec7f9b8d577b265e6b7a584f38c929edb8d4ec9d23f94e28229"}}}, &(0x7f0000000540)={0x2c, &(0x7f0000000240)={0x40, 0x17, 0xa9, "30aa97c7a29bbb15c60e9583bf22411f9a170865fc80ccccf0598353b471483063c9a79e6ce69365b691b6322ace3b5a1395e7c5c388e0aad6a12a717941c714a04130eec77f81bdb130f931143ce0d8a86c37eaa3fe4836dbc0c2b929acd4d61580688d24f772500e818b2d52a6aa3e2b242f13254f2e21a6595fc1ecb8c23683e2c31df04e5eab34bbf31c30cfde7117dc7f0ce0b59de9cf480fc7d8da6288fbfb1d91b43cbb69c4"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x71}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f00000004c0)={0xc0, 0x5, 0x4, "9d642267"}, &(0x7f0000000500)={0x40, 0x5, 0x3, "6631fa"}}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000000c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x80, 0x1c, {0x401, 0xa08, 0xfffffffc, 0xb, 0x441, 0x5, 0x7fff, 0xfa97, 0x200, 0xd, 0x1fe, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = syz_usb_connect$midi(0x4, 0xd5, &(0x7f0000000580)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc3, 0x1, 0x1, 0x81, 0xa0, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x5, 0x1, 0x3, 0x20, 0x6, [@midi_out_jack={0xd, 0x24, 0x3, 0x5, 0xc, 0x3, [{0x81, 0x3}, {0x5, 0x1}, {0x0, 0xc}], 0x5}, @midi_in_jack={0x6, 0x24, 0x2, 0x3, 0xbb, 0x1}, @ms_header={0x7, 0x24, 0x1, 0x0, 0x7}, @ms_header={0x7, 0x24, 0x1, 0x2, 0x7}, @midi_out_jack={0x1b, 0x24, 0x3, 0x1, 0xf8, 0xa, [{0x0, 0x1}, {0xc4, 0x2}, {0x2, 0x2}, {0x5, 0x10}, {0x1, 0xfe}, {0x6f, 0x4}, {0x7, 0xeb}, {0x97, 0x3}, {0x4, 0x1}, {0x6, 0x7}], 0x17}, @ms_header={0x7, 0x24, 0x1, 0x8694, 0x7}, @midi_out_jack={0xb, 0x24, 0x3, 0x3, 0xf, 0x2, [{0x0, 0x9}, {0x4, 0x6}], 0x50}], [{{0x9, 0x5, 0xb, 0x8, 0x40, 0x42, 0x7, 0xd7, {0x5, 0x25, 0x1, 0x1, "b7"}}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x6, 0x9, 0x2, {0x6, 0x25, 0x1, 0x2, "5a04"}}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0x0, 0x9, 0x7, {0x11, 0x25, 0x1, 0xd, "63e0d2aef1ba9044087d93ee9a"}}}, {{0x9, 0x5, 0x6, 0x1, 0x40, 0x8, 0xab, 0x5, {0xf, 0x25, 0x1, 0xb, "24357be22ace8a114400b6"}}}, {{0x9, 0x5, 0x6, 0x3, 0x10, 0x5, 0x7, 0x3, {0xb, 0x25, 0x1, 0x7, "1e722b33df6063"}}}]}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x201, 0xb, 0x6, 0xb, 0x40, 0x40}, 0xc, &(0x7f00000006c0)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x6, 0x8, 0x3}]}, 0x9, [{0x29, &(0x7f0000000700)=@string={0x29, 0x3, "2da228eaf89cd9800317e0bcfbe01cd72e2daa896fd67ed16701f8ad53a618c6b3f8b66ea2e26c"}}, {0x85, &(0x7f0000000740)=@string={0x85, 0x3, "2169bbe23dcfcfae6287b32018b696f90fad071ac115733f1c1c5fa6cabb2dc5bbc3c1357de86b41b76c946046051a30b49f474ab599a17fedc3e4ea8206f48e69fc952a7ec236a7d669ea903f251d73f5e45b312c0d91aea361f2468d78ba954ebf009d5312cccfb32148f3cbdbf85dfd898f3afe207442d608de2855df1117ced247"}}, {0x20, &(0x7f0000000800)=@string={0x20, 0x3, "0de4fbc516933cd01aecd8b3dd856b25ab3be2626389fe578c26d2de54a1"}}, {0x79, &(0x7f0000000840)=@string={0x79, 0x3, "ac71f0493940d5399c567f50c1b6b5b9e5b9bf6c65c77329ddd7e6327a604f421b68ccf6a04032cfe33764a596de7429ac1b93d76c87e7710e7d3737ed67d984877600daf4671bae64798d5572340023c659b97cd299c01bc9b1f4420fdd8bd1aa3aa16cfaebf5a861a4c9110b34fb2fe23841635e5666"}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x424}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x455}}, {0x81, &(0x7f0000000940)=@string={0x81, 0x3, "7de67e2c7136835db6f141b73e8461d1846fe6f9108d1b3caee862a56da531e16e062720e6cb6e32396e13f6eeaabd9332bf8dec35360ab5334e08a7e6a491117435c8ec019e76205c044fa12b988c84e008e2a142dd8e71dc35a5b7da8d1a0f6f55204c6636000d656947de699cb32d59feb34ee19732a6d7f344bb3f9213"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x400a}}]}) syz_usb_control_io$uac3(r2, &(0x7f0000000bc0)={0x14, &(0x7f0000000b40)={0x40, 0x1, 0x24, {0x24, 0x23, "c2871af182cd43c9a70d25e86b7a87229f6db5469cac5703b86e9033dcb9ff884066"}}, &(0x7f0000000b80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1001}}}, &(0x7f0000000e80)={0x44, &(0x7f0000000c00)={0x40, 0xc, 0x8a, "03839ddd6d2009c08668ecb34b331e46591738eee731c47465d18a027cb25ca738407a976636b82afb31a91817b04bede0831613873f017f99b90804ecc4f2e21728ea3ae25f494865b0084060183510eb62c932c38d11d74113f21d8a4411e64029a08f6fe303239b3de19cf5c7170661538c426c9407f64b7df54f6a684eb060bfd62ff989217f86e2"}, &(0x7f0000000cc0)={0x0, 0xa, 0x1, 0x3b}, &(0x7f0000000d00)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000d40)={0x20, 0x81, 0x1, "8a"}, &(0x7f0000000d80)={0x20, 0x82, 0x3, "9ed852"}, &(0x7f0000000dc0)={0x20, 0x83, 0x1, '6'}, &(0x7f0000000e00)={0x20, 0x84, 0x3, "6fa8c1"}, &(0x7f0000000e40)={0x20, 0x85, 0x3, "0f800d"}}) executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) (async) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x109040, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) (async) r4 = dup3(r3, r2, 0x0) renameat2(r0, &(0x7f0000000280)='\x00', r0, &(0x7f00000002c0)='./file0\x00', 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) r6 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x10000000000) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) (async) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x1e, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x130, 0x0, &(0x7f0000000c80)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1068, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x2000000000033}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x400000001, 0x8}, @flat=@binder={0x73622a85, 0x1000, 0x2}}, &(0x7f0000000240)={0x0, 0xfffffe78, 0x50}}, 0x1000}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @request_death={0x400c630e, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000b00)={@flat=@weak_handle={0x77682a85, 0x100, 0x1}, @flat=@weak_binder={0x77622a85, 0x10b, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x1}}, &(0x7f0000000b80)={0x0, 0x18, 0x30}}}, @free_buffer={0x40086303, r6}], 0x0, 0x0, 0x0}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) program crashed: WARNING in shmem_rmdir bisect: bisecting 24 programs bisect: split chunks (needed=false): <24> bisect: split chunk #0 of len 24 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 30, 20, 4, 16, 10, 3, 30, 14, 10, 7, 6, 30, 8, 14, 21] detailed listing: executing program 3: openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080), 0x2642, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = accept(r0, &(0x7f00000000c0)=@ethernet, &(0x7f0000000040)=0x80) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0xd, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_usb_connect$uac1(0x2, 0xdc, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r3, @ANYRES16=r2], 0x0) executing program 0: unshare(0x64000400) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = dup(0xffffffffffffffff) unshare(0x24020400) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) (async) r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0), 0x2) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r6, 0x0) (async) ioctl$UDMABUF_CREATE_LIST(r5, 0x40087543, 0x0) (async) inotify_init1(0x0) (async) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0x6, 0x1, 0x0, 0x5, 0x81, 0xfff9}, 0x20) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000340)={0x400000100002f, {0x0, 0x0, 0x0, 0x6}}) (async) r10 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000180), 0xe1742, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000880)={'syz1\x00', {0x4, 0x9, 0xe, 0x2}, 0x2b, [0x6, 0x8, 0x1, 0x2, 0x10001, 0x5, 0x3ff, 0x6, 0xe, 0xa93, 0x5, 0x7, 0x1ff, 0x5ce1, 0x3, 0x100, 0x267, 0x212, 0x8, 0x3, 0x4, 0x3ff, 0x1, 0x1000, 0x3ff, 0x8, 0x4, 0x0, 0x6, 0x200, 0x10000, 0x2e, 0x9, 0x800, 0x2000000, 0x0, 0x0, 0x3, 0x2, 0x6, 0xfffffffe, 0x1, 0x80000001, 0x5, 0x5, 0x1, 0x400, 0x1, 0xfbf2, 0x0, 0x5, 0x2, 0x77, 0x9, 0x100, 0x16a, 0x2, 0x8, 0xb6a, 0x0, 0x1ff, 0xe, 0x80, 0x2542], [0x1, 0x8, 0x157, 0x7, 0xe3, 0x160000, 0x4, 0x9, 0x4, 0x3, 0x1, 0x5, 0xa00000, 0x4, 0xffff0000, 0x10001, 0x63b, 0x10, 0x8, 0x9, 0x400, 0x7, 0x0, 0x4, 0x8, 0x7, 0x3, 0x5, 0x80000000, 0x1, 0x6, 0xffffffa7, 0xe0000000, 0x7c, 0x7, 0xfffffffe, 0x8079, 0x6, 0x9, 0x8, 0x1000, 0x4, 0x6, 0x1, 0xa, 0x1, 0x5, 0x3, 0xd4b, 0xdfa, 0xa, 0x5, 0x9, 0x5, 0x1, 0x9e, 0x4, 0x4, 0x0, 0x8, 0x80000001, 0xffffffff, 0x84a, 0x5], [0x407, 0x7, 0x0, 0x5, 0x5, 0x1df, 0x8, 0x6, 0x45c00000, 0xfffffff9, 0x0, 0x4, 0x8, 0x62, 0x0, 0x1, 0x3, 0xf87, 0x3, 0x0, 0x400, 0x10, 0x7, 0x4, 0x61c8, 0x5, 0x1c0, 0x9, 0x3, 0x4, 0xf, 0x80, 0x2, 0x1, 0xb4a2, 0x92bc, 0x5, 0x4, 0x3, 0x1, 0xe, 0x9, 0x9, 0x590, 0x9d5c, 0x81, 0x0, 0x1, 0x9, 0x9, 0x0, 0x6, 0x2, 0x7ff, 0x81, 0x7, 0x7, 0x9, 0x8001, 0x18, 0x1, 0x93e, 0x401, 0x810], [0x100, 0x3, 0xfffffffa, 0x0, 0x6, 0x8, 0x3ff, 0x4, 0x9, 0x5, 0x7, 0x1, 0x0, 0x8, 0x4, 0x6, 0x400, 0x4, 0x2, 0x1000, 0xbfc, 0x2, 0x8, 0x7fffffff, 0x800, 0x8000, 0x12, 0xffff9268, 0x1ba, 0x5, 0x3, 0xffff, 0x400, 0x400, 0x1af4, 0x7bb1, 0xb3d, 0xfffffffd, 0x7fff, 0x0, 0x80000000, 0xce, 0x198, 0x1, 0xffffff9a, 0x4, 0xf14, 0x9, 0x7ff, 0x7, 0x886, 0x1, 0x7, 0x7, 0x1000, 0x0, 0x2, 0x5, 0x20000000, 0xa3f5, 0x36, 0x7fff, 0xd3cf, 0x5]}, 0x45c) (async) write(r10, &(0x7f0000000000)="88de80841d87", 0x6) (async) close_range(r8, 0xffffffffffffffff, 0x0) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0xf78, 0x2, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x2, 0x9, 0x5, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x4, 0xb, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xe, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xe, 0x0, 0x71, 0x2, 0x6, 0x789, 0x50, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x401, 0x12f, 0x6, 0x10, 0x9, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x5, 0xffe, 0xfffffffc, 0x62b, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0xfffffff8, 0x9, 0x402, 0x401, 0x6, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0xbcf5, 0x1, 0x2, 0x2, 0x9, 0x3000000, 0x9, 0x0, 0x9, 0x6, 0xb, 0xff, 0x1, 0x9, 0x4fbd, 0x2, 0x7f, 0x9, 0x8, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x2c, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x4, 0x5, 0x1005, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xfffffff6, 0x7, 0x7, 0xfffffff9, 0x6, 0xb8d, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x5, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x6, 0x1, 0x0, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0xfd, 0x10000, 0x7, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x8, 0xc8, 0x4, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9600, 0x5, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) (async) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) r1 = syz_open_dev$hiddev(&(0x7f00000001c0), 0x80000000, 0x10301) ioctl$HIDIOCGCOLLECTIONINFO(r1, 0xc0104811, &(0x7f0000000200)={0xaa5f, 0x2, 0x1, 0x1}) r2 = socket(0x11, 0x3, 0x4000000) r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0x40000000200, 0x101301) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0xfffffff8, 0x40, &(0x7f0000000080)={0x4b5a9da54893e123, 0x3, 0x10, 0xfffd}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x20004, 0x0}) r4 = socket$inet6(0xa, 0x1, 0x0) r5 = dup2(r4, r4) ioctl$sock_inet6_SIOCDELRT(r5, 0x890c, &(0x7f00000000c0)={@remote, @private0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40003, 0x40, 0x5, 0x100, 0x0, 0x590029}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000880)={'ip6gretap0\x00', 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r8, 0x5452, &(0x7f0000000040)=0xcd8) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) syz_usb_connect(0x0, 0x5d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a"], 0x0) close(r7) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f0000000080)={'HL\x00'}, &(0x7f00000000c0)=0x1e) bind$packet(r2, &(0x7f0000000540)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000000)=0xe9, 0x4) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000100)={'ah\x00'}, &(0x7f0000000140)=0x1e) sendmsg$netlink(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="3f011400e0dc14"], 0xdd12}], 0x1, 0x0, 0x0, 0x4000054}, 0x0) executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_selinux(r0, &(0x7f0000000080), 0x0, 0xfe, 0x2) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) mount$cgroup(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x2010400, &(0x7f00000001c0)={[{@name={'name', 0x3d, '\x00\x00\x00\x00\x00'}}]}) executing program 0: r0 = userfaultfd(0x801) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x2, @mcast2}, 0x1c) r2 = socket(0x1a, 0x4, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6c0000001900010000000000fbdbdf251d010900500012804900f880e02b4221d3c744305f542a963097bf883548fe5ae164e5e6f4e0fb772aa1dc9e0330c9c8d1a98a1e02167abc021907e655c6053ebde9f7c472a700000008000e007f00000100"/108], 0x6c}, 0x1, 0x0, 0x0, 0x5}, 0x0) mmap(&(0x7f0000bc1000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x2ec37000) r3 = socket$inet(0x2, 0x4, 0x1) bind$pptp(r2, &(0x7f0000000040)={0x18, 0x2, {0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x1e) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x8, 0x32, 0xffffffffffffffff, 0x6931b000) write(r3, &(0x7f0000000080)="08008edf773c8000", 0xfd) r4 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000201c1b091c00000000000109022d0001000060000904008002030000000921080400012205000905810320000908070905020340"], 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_ep_read(r4, 0x2, 0x0, 0x0) r5 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0xa, r5, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000000)='ix:\x88\xfe\xf7\x01') ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) executing program 1: syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0x7fffffffffffffff]}, 0x8, 0x80000) (async) io_setup(0x2, &(0x7f0000000200)=0x0) io_submit(r1, 0x47f, &(0x7f00000005c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f00000003c0)="951aa14bd6f68579cac67c83bf8d4500e5cea1bb1596d4ee6645fa16fa7cacb9214070a622a2c57b89075f59b85c7b5b2c41edc9d2cd5a2c95ed1c2cf72425be9c1a2df1b60a309bc3228d7e85b300f0d7a042a40166b9208e9d2e423c32ad8e47adedf5dc425c6bcb031fb2230835d41afc23476eae602bad3246417e5ac757", 0x80}]) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000005) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f00000001c0)=0x7) (async, rerun: 32) write$FUSE_INIT(0xffffffffffffffff, &(0x7f00000002c0)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x0, 0x5f8f4c58, 0x1, 0x101, 0x7, 0xa15, 0x0, 0x0, 0x20, 0x2}}, 0x50) (rerun: 32) shutdown(r0, 0x0) syz_usb_connect$uac2(0x3, 0xa8, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x30df, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x96, 0x3, 0x1, 0x0, 0x30, 0x3, {0x8, 0xb, 0x0, 0x2, 0x1, 0x3, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x6, 0x26, 0x3}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x1, [0x0, 0x0, 0x3, 0x2, 0x1, 0x0]}, @output_terminal={0xc, 0x24, 0x3, 0x2, 0x302, 0x1, 0x3, 0xd, 0x7, 0x80}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@as_header={0x10, 0x24, 0x1, 0x8, 0xd7, 0x3, 0x3, 0x0, 0x75cd, 0x6}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x8, 0x5, 0x0, {0x8, 0x25, 0x1, 0x1, 0x6, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0xe6, 0x40, {0x8, 0x25, 0x1, 0x3, 0x33, 0xfe, 0x5}}}}}}}}]}}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x4, [{0xd3, &(0x7f00000000c0)=@string={0xd3, 0x3, "20bfe43509b09be426727e8f039aaf14093dba3dff3951ea8674c098f07d46f23529800a27df74fd00af36bc02145c76a2bec1a5956f8df6b0ab4e1b497a0f7367d3b456f3c78bf73f155a80e7b836c6279a88f5d2058c77ea67c2a56ec8f23aa3fdf77b77fa29e0378a9bf9a39eaf50a6d5e69fbedc76874ddee42800b94d89d54ce01824e9b9803ecd584b39dbf8697a4b7cf4c67817112020f71cb041c2ebc9c9293e20dc45dcabb2345e3c7d8794f543578ecc3cdd819449970cb21136da04b364f7f6792ce7cae0e72a9ca2ba1bba"}}, {0x45, &(0x7f0000000300)=@string={0x45, 0x3, "b1823ae370c773fc8b6707999fadf27e62813c0d45fe3eef29f14766f68a0ca3de0318175d3fb50fef4e1331950a926c979f749c65588da411709f69b84f34ffc55873"}}, {0x9c, &(0x7f0000000480)=ANY=[@ANYBLOB="9c039d3bfe0084b16fbcbf4c73895a18ce821f32c9cb437e50a1ef26daaa372b51bf61a5504596c115f5d46eda4878ccd00a08af209a29e49930d8f5385edf2de7094ae2d2f746d7594184279807d2ba47f639d8ccf4d7717f5eed18bc46595b5ae63b94c7e46c5846571c143aeb27f79fa23a70a192425de334c7fbf29f9e1754e072526a2ec4116327fb3032d81e1f6f36b12768551189387609be"]}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x1401}}]}) (async) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r0, 0x4068aea3, &(0x7f0000000540)={0xdf, 0x0, 0x6000}) executing program 0: ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000b40)={{0xffffffffffffffff, &(0x7f0000000040)='\x00', 0x800c2, &(0x7f0000000080)={@_ha_fsid={[0x5, 0xebc]}, {0x46, 0xb, 0x6, 0x19c4}}, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x8}, 0xc, &(0x7f0000000dc0)=[{0x3, 0x7fff, &(0x7f0000000140)='$\x00', &(0x7f0000000180)="e2e5131823f1ba94a4d043d073e2af6abd1ccfae25cf520038bca9fda21c24b98592f1b7f3de35dc5f9476ad4f8161039897ab390c59d36fa1310f48db0b1f13bb993b8c410a27a34b3d64a9dbb17347eabc05eeccc562de3087763f3ec032e8b89b88a8842429247fe312eed1c51da77aa36de7b77e8068d398449e44b5d39938eb8ad5493bb6f06375e718", 0x8c, 0x20}, {0x3, 0x0, &(0x7f0000000240)='\x00', &(0x7f0000000280)="0a0e7c8757b055ce285f9461f2f6278a675020eaaeb6ab20964faa0d6a9a66e2db8c59df62aed6c6ab6d3969c220d06c69f3a50ab0f69173ee7feb950c18aa9177f9e85f7cb2d31308e3908c35e31ec00a5ec39f8b5bd2525ef1c94f79", 0x5d, 0x4}, {0x2, 0xfffffff0, &(0x7f0000000300)=')\xce,+\x00', &(0x7f0000000340)="59c1de541398f85df8b02d98ae0652d581ad6f9549c765eec43a539cb330cdc78ffdb11f19339b92f64adee30487526979f0ce7d3443c4778d6844d30df3355e89999fb9cf0c16d4732d1b58da7511c4132c63e3298869ea63c1c6711c581385e4adf53f2a745c861d7d508f399f2376198288611c622cb01ce526ec005084624193951b4448cafa82b7da28ae46d0f9b1f8ab2543299570446bafb3274f7f4a2172", 0xa2, 0x2}, {0x0, 0x5f9d, &(0x7f0000000400)='-\x00', &(0x7f0000000440)="79c815307b20c1baa989e3a26092f32134633897dcc3529e8945cdc3f4ab95da3ae3f18c0253ee11b1ced76f82ceaf66678e1153e456cb9fc8cca313bc82667789b80583baebc9ca6c79d802ab95206350263b574faec069679d629a849e72c625f330354a5bbb9a7b57e002b762fa1b3bd529b8691f99c7", 0x78, 0x22}, {0x3, 0x8, &(0x7f00000004c0)='\r\xde\x00', &(0x7f0000000500)="56bc887d32e6277466d802d8182de9ccb1f6d4e17c48203f205ae7caa895e7e7458ceb6481b5598d1e819f817b2f962c3e229ca9a337d8bf316450aa2c35d5897d512133158f5d61e8619fee84912b9ab147adecaeb99a69eb93c615214467c8ecfd23a7e8a29d544c3ba1687553d76da85ecd0fbc2fdb68dc3dfd48c5ac6f4e7f54437dae2e94106b4b43c143205dad05cd2473497abe3ace45e3832add5562d2b986252eee45b5129c7cee4b39a62b22ab05c2934911e4c321c8a38b5733be118488f83d080ee23cbb476ffa4038624ffddf4c58b17aaab57f6619691cc5f93ef66b5d8ab5580d0525a2ce75fd1a27341e0a08", 0xf4, 0x20}, {0x1, 0xfffffff1, &(0x7f0000000600)=':^{$\'/\'$Y{\'&,.+^\x00', &(0x7f0000000640)="2309f2ebf41f64aa73656021319f1c923e588509b6cf75424c5e380789bd79bac2d7b0b298be8e7ddbd017d7117b60da08ebda9b05f15c081771802d0520ede386dbc5df8ed660cec5c0f9c0d9150155dd8e82ab063f046ac49d0e7831e56e391a9214baf41909d349f7bae48ee66dedf6", 0x71, 0x38}, {0x2, 0x4, &(0x7f00000006c0)='(%\x00', &(0x7f0000000700)="faf39ce8654501bca2b4e41aeb5e3c721ad3980ac299c97d3013f18ae233ec5e9b4282b9077bce94d0ad79390cf01ce71e5809f99914c6e6cb47da8c6e8d2097a53981b02076385fb8ac55174e7d81693ea5273b02ea28774fe3eff2f3a14f8a8543603a104814323964b22034eb7c579d943dab4f59941f5d17adb14b6432dd6b2d4c8b2dd3f9f2183cc0cc175352ac32a91dbf9d17aa2631cbca901e2efd2351bc9aefde9c64708551bc4d5ff7509bbbc2d2946f83ed37e9f37cf23686923e6f830756f475ba14826a6e643198984666a587bab78190bd56", 0xd9, 0x38}, {0x2, 0xfffffffc, &(0x7f0000000800)='[-.](^#*{**\x00', &(0x7f0000000840)="a8be5e94db2b1f46cf4b54863b04a06dbba37ec5ad975ddda04e57d3a72852a62f849a4655334040e892d00a6dd57f72e3b86ddd0c0853354ae340a4931f5d60bd258614227c3a4d78752e3048a46d4b050aeb5cc957d6415328a4c23cd58df8817c4063b3a86981c83d671fc3482a", 0x6f, 0x1}, {0x3, 0xd, &(0x7f00000008c0), &(0x7f0000000900)="9e807704f391864ca5bab6830b3830104888b9f5c66b438b8d8ee26a2c6f477863cb021cf597aa7a726a36bf03617875f34a14d96587e8cb8f96d0b42b85be2b907087f6d209b5c3003c5b4f4c90a789bbaf64740ca520980db6efded2d9ec8ea7bb99901d551ebd66d76dcd523a007a24d0442a5b1738372bb53dc4c97ca67ae768d4d9fe45adf3aac42eeea8c351734ed044281918420f6ac9ea0e5bb138e193f9e70df632380116c2903bb90b51b43975dc59af44b1c9f17998596dd7555642520a0fd7fec85a90f15cd07b90bd91d6bb45b87d8b67b9137b90cce6488da56444256b1201a1decf2df2", 0xeb, 0x12}, {0x1, 0xb, &(0x7f00000008c0)='\x00', &(0x7f0000000c00)="4e986a21909dec2f", 0x8, 0xa}, {0x1, 0x400, &(0x7f0000000c40)=')\xce,+\x00', &(0x7f0000000c80)="ae04a3c64406f2a147b5e3e3e87de6d4a27ec9a81bad289dd446e22e3a7fa1082b97685714d4f95e626df805078a9a94ab", 0x31, 0x8}, {0x3, 0x5, &(0x7f0000000cc0)='-\x00', &(0x7f0000000d00)="68c34e832a6f04603168f99130893d60918156fdbe81cb6819345f0e789a4ee883e9c1bc0f0fbdee89c70e25ba336b0a4ff63044606f50932203022fd1ecaf8ef2b4ed37716514b7eb17e68b20bc305ca30f60058fd92598bcf5021503d211a2beb3e94c70650e3b3cc122c6b969d4490721d321f9b121dc6c3d0857e21d1a86ca0dc34c7b17ff32eaf8a5da56abf585d216b83cea1c5acf7627d62164", 0x9d, 0xa}]}) ioctl$BLKSSZGET(r0, 0x1268, &(0x7f0000000bc0)) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x1, 0xf0, 0xc9, "", [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x1, 0x3, 0x6, {0x9, 0x21, 0xfffc, 0x77, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x5, 0x48}}}}}]}}]}}, 0x0) executing program 3: ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f0000000300)=[@wrmsr={0x65, 0x20, {0x40000091, 0x3}}], 0x20}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000140)={0x1, 0x0, [{0x40000001, 0x1, 0x5, 0x31237648, 0x80000006, 0x82, 0x4}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r3, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200"], 0x2c, 0x3) r4 = socket$tipc(0x1e, 0x5, 0x0) recvmmsg(r4, &(0x7f0000004b40)=[{{0x0, 0x0, &(0x7f0000007580)=[{&(0x7f00000000c0)=""/46, 0x2e}], 0x1}, 0x7fffffff}], 0x1, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x3a, [0xfffffff8, 0x8, 0x5, 0x10009, 0x8, 0x155f, 0x6, 0x2, 0x25cd, 0x1, 0xb4, 0xa, 0xb2b9, 0x6, 0x8, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x1000, 0x1, 0x8, 0x80d, 0x4, 0x12a0, 0x8000, 0x1, 0x7, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10001, 0x5, 0x91, 0x4, 0x4, 0x16, 0x2, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x2, 0x2, 0x2, 0x2, 0x7, 0x4, 0x7, 0x4, 0x4007f, 0xffffffff, 0x9], [0x9, 0x16e, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0xfffffffe, 0x80a, 0x4, 0xa7, 0x7, 0x0, 0x200b395, 0x400000, 0x80000000, 0x4, 0x19, 0x7, 0x1, 0x3, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x96, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1ce, 0x1, 0x80000004, 0x80000001, 0x6, 0x2, 0x9, 0x95, 0x80000000, 0x4, 0xfffffff9, 0x40000003, 0x1000, 0xfffff804, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x328, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x3fc, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x5, 0x89, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x7ffe, 0x401, 0x3e55, 0x5, 0xd3, 0x8, 0x3437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0x0, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0x3, 0x20008, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x8000007, 0x1e, 0x9, 0x81, 0x3, 0x9d86, 0x9, 0xfffffff7, 0x8, 0x7, 0x5396, 0x939, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xffffffff, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x0, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0xc, 0x463f, 0x4, 0xdab, 0x8003, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f0000000380), 0x14c98, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r10 = dup(r9) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r9, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae03, 0x28) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x7, 0x8dc, 0xffffffbf, {}, {r1, r2/1000+10000}, {0x2, 0x1, 0x1}, 0x1, @can={{0x3ff, 0x1, 0x1}, 0x8, 0x0, 0x0, 0x0, "2064e7609a783858"}}, 0x48}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000b80)={0x14, 0x0, 0x2, 0x303, 0x0, 0x0, {0x5, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r3 = socket(0x10, 0x803, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000020000000800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x40) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x44800) sendmsg$NFQNL_MSG_CONFIG(r5, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000080)=ANY=[@ANYBLOB="30000000020301"], 0x30}, 0x1, 0x0, 0x0, 0x40840}, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f00000001c0)=""/17, 0x11}, {&(0x7f00000007c0)=""/141, 0x8d}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f0000000000)=""/39, 0x27}, {&(0x7f0000000040)=""/98, 0x62}], 0xa, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x2000, &(0x7f0000003700)={0x0, 0x3938700}) executing program 1: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') syz_pidfd_open(0x0, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x10000000) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000003140)={'sit0\x00', 0x0}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x61) copy_file_range(r1, 0x0, r1, 0x0, 0x1000000001ff, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4080000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0xd, r2, 0x200, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_usb_connect(0x0, 0x24, &(0x7f00000023c0)={{0x12, 0x1, 0x110, 0x68, 0x7a, 0x3d, 0x40, 0x19d2, 0x1255, 0x91, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x8, 0x38, 0x6, "", [{{0x9, 0x4, 0x9, 0x3, 0x0, 0x2, 0x6, 0x0, 0x9}}]}}]}}, 0x0) executing program 1: r0 = socket(0x6, 0x0, 0x3e) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000080)=0x5, 0x4) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32, @ANYBLOB="08004e01"], 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x4) (async) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd85d82, 0x0) executing program 1: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xd965, 0x800, &(0x7f0000000180)={0xc9, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) recvmmsg(r5, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/160, 0xa0}], 0x1}, 0x1}], 0x1, 0x2, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x10000000) (async) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000023c0)={0x0, 'vlan1\x00', {0xffe}, 0x6}) executing program 0: r0 = syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000020000402505a1a440000002030109025c0002010000000904000001020d0000052406000105241000000d240f0100000000060000010006241a0000000905810300020000000904010000020d00000904010102020d0000090582020002000000090503f53f39d33169b12395de019d9d8d07520c20664f05a7982976374e688c67f7f17c9dd09247bdb7fbcd84905d1bca7d24a81ebed7367b96c7f3d16eb5a8c6e2d2dbdafb00084b5b7618ad60c1918ce5a37e45fcbf660fb2916303b10dd6aeb6bc1731e8a1c757401e704723aac18830f01f278a797bf6eccb5ee5441341b3883dd3afd9d165a55220cfe0a2918efdc52e024eb9e3e44ef6bae1a0f47ad9c2d515298951651821c808159fbf09605617e11040a73626a3faa0ebdf2e5aed7dd8693b041b7299b5c6c1e5b33957b1c933748a"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) mkdir(&(0x7f0000000840)='./file0\x00', 0x145) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) setresgid(0x0, 0x0, 0xee01) utimes(&(0x7f0000000200)='./file0\x00', 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000080)={0x14, &(0x7f0000000040)={0x20, 0x34, 0xf, {0xf, 0x7, "c5984a926bc1433e2ed91f1d86"}}, &(0x7f0000000140)={0x0, 0x3, 0xf3, @string={0xf3, 0x3, "7bbc05a293951190558746304432ff5b195ce85e635b4b917859b61bf6fe0e2d82d2086f10acdea5a3bda37f7d39e933852367994b6e48f8344cfd9c589199ab1eea504469cbd204216e258fbd345289580ab8860cfac3c123099f845b13b76aafb271c860ecf818f9766a3a5f6449dd5852cd5995fc1a25cd5dd18a50dc553036c58662bb480f1184b3d7e847330b6f1e0a6f8f52b507b1243815562cad3c858d704bf4ae81010c8001babdb6ec5e5e54f4bb6bebe13cc04bb1774c8a85e3ea0379cca08493614541b2a867f1958a77d7afc9e53105e5aec7f9b8d577b265e6b7a584f38c929edb8d4ec9d23f94e28229"}}}, &(0x7f0000000540)={0x2c, &(0x7f0000000240)={0x40, 0x17, 0xa9, "30aa97c7a29bbb15c60e9583bf22411f9a170865fc80ccccf0598353b471483063c9a79e6ce69365b691b6322ace3b5a1395e7c5c388e0aad6a12a717941c714a04130eec77f81bdb130f931143ce0d8a86c37eaa3fe4836dbc0c2b929acd4d61580688d24f772500e818b2d52a6aa3e2b242f13254f2e21a6595fc1ecb8c23683e2c31df04e5eab34bbf31c30cfde7117dc7f0ce0b59de9cf480fc7d8da6288fbfb1d91b43cbb69c4"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x71}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f00000004c0)={0xc0, 0x5, 0x4, "9d642267"}, &(0x7f0000000500)={0x40, 0x5, 0x3, "6631fa"}}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000000c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x80, 0x1c, {0x401, 0xa08, 0xfffffffc, 0xb, 0x441, 0x5, 0x7fff, 0xfa97, 0x200, 0xd, 0x1fe, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = syz_usb_connect$midi(0x4, 0xd5, &(0x7f0000000580)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc3, 0x1, 0x1, 0x81, 0xa0, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x5, 0x1, 0x3, 0x20, 0x6, [@midi_out_jack={0xd, 0x24, 0x3, 0x5, 0xc, 0x3, [{0x81, 0x3}, {0x5, 0x1}, {0x0, 0xc}], 0x5}, @midi_in_jack={0x6, 0x24, 0x2, 0x3, 0xbb, 0x1}, @ms_header={0x7, 0x24, 0x1, 0x0, 0x7}, @ms_header={0x7, 0x24, 0x1, 0x2, 0x7}, @midi_out_jack={0x1b, 0x24, 0x3, 0x1, 0xf8, 0xa, [{0x0, 0x1}, {0xc4, 0x2}, {0x2, 0x2}, {0x5, 0x10}, {0x1, 0xfe}, {0x6f, 0x4}, {0x7, 0xeb}, {0x97, 0x3}, {0x4, 0x1}, {0x6, 0x7}], 0x17}, @ms_header={0x7, 0x24, 0x1, 0x8694, 0x7}, @midi_out_jack={0xb, 0x24, 0x3, 0x3, 0xf, 0x2, [{0x0, 0x9}, {0x4, 0x6}], 0x50}], [{{0x9, 0x5, 0xb, 0x8, 0x40, 0x42, 0x7, 0xd7, {0x5, 0x25, 0x1, 0x1, "b7"}}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x6, 0x9, 0x2, {0x6, 0x25, 0x1, 0x2, "5a04"}}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0x0, 0x9, 0x7, {0x11, 0x25, 0x1, 0xd, "63e0d2aef1ba9044087d93ee9a"}}}, {{0x9, 0x5, 0x6, 0x1, 0x40, 0x8, 0xab, 0x5, {0xf, 0x25, 0x1, 0xb, "24357be22ace8a114400b6"}}}, {{0x9, 0x5, 0x6, 0x3, 0x10, 0x5, 0x7, 0x3, {0xb, 0x25, 0x1, 0x7, "1e722b33df6063"}}}]}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x201, 0xb, 0x6, 0xb, 0x40, 0x40}, 0xc, &(0x7f00000006c0)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x6, 0x8, 0x3}]}, 0x9, [{0x29, &(0x7f0000000700)=@string={0x29, 0x3, "2da228eaf89cd9800317e0bcfbe01cd72e2daa896fd67ed16701f8ad53a618c6b3f8b66ea2e26c"}}, {0x85, &(0x7f0000000740)=@string={0x85, 0x3, "2169bbe23dcfcfae6287b32018b696f90fad071ac115733f1c1c5fa6cabb2dc5bbc3c1357de86b41b76c946046051a30b49f474ab599a17fedc3e4ea8206f48e69fc952a7ec236a7d669ea903f251d73f5e45b312c0d91aea361f2468d78ba954ebf009d5312cccfb32148f3cbdbf85dfd898f3afe207442d608de2855df1117ced247"}}, {0x20, &(0x7f0000000800)=@string={0x20, 0x3, "0de4fbc516933cd01aecd8b3dd856b25ab3be2626389fe578c26d2de54a1"}}, {0x79, &(0x7f0000000840)=@string={0x79, 0x3, "ac71f0493940d5399c567f50c1b6b5b9e5b9bf6c65c77329ddd7e6327a604f421b68ccf6a04032cfe33764a596de7429ac1b93d76c87e7710e7d3737ed67d984877600daf4671bae64798d5572340023c659b97cd299c01bc9b1f4420fdd8bd1aa3aa16cfaebf5a861a4c9110b34fb2fe23841635e5666"}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x424}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x455}}, {0x81, &(0x7f0000000940)=@string={0x81, 0x3, "7de67e2c7136835db6f141b73e8461d1846fe6f9108d1b3caee862a56da531e16e062720e6cb6e32396e13f6eeaabd9332bf8dec35360ab5334e08a7e6a491117435c8ec019e76205c044fa12b988c84e008e2a142dd8e71dc35a5b7da8d1a0f6f55204c6636000d656947de699cb32d59feb34ee19732a6d7f344bb3f9213"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x400a}}]}) syz_usb_control_io$uac3(r2, &(0x7f0000000bc0)={0x14, &(0x7f0000000b40)={0x40, 0x1, 0x24, {0x24, 0x23, "c2871af182cd43c9a70d25e86b7a87229f6db5469cac5703b86e9033dcb9ff884066"}}, &(0x7f0000000b80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1001}}}, &(0x7f0000000e80)={0x44, &(0x7f0000000c00)={0x40, 0xc, 0x8a, "03839ddd6d2009c08668ecb34b331e46591738eee731c47465d18a027cb25ca738407a976636b82afb31a91817b04bede0831613873f017f99b90804ecc4f2e21728ea3ae25f494865b0084060183510eb62c932c38d11d74113f21d8a4411e64029a08f6fe303239b3de19cf5c7170661538c426c9407f64b7df54f6a684eb060bfd62ff989217f86e2"}, &(0x7f0000000cc0)={0x0, 0xa, 0x1, 0x3b}, &(0x7f0000000d00)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000d40)={0x20, 0x81, 0x1, "8a"}, &(0x7f0000000d80)={0x20, 0x82, 0x3, "9ed852"}, &(0x7f0000000dc0)={0x20, 0x83, 0x1, '6'}, &(0x7f0000000e00)={0x20, 0x84, 0x3, "6fa8c1"}, &(0x7f0000000e40)={0x20, 0x85, 0x3, "0f800d"}}) executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) (async) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x109040, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) (async) r4 = dup3(r3, r2, 0x0) renameat2(r0, &(0x7f0000000280)='\x00', r0, &(0x7f00000002c0)='./file0\x00', 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) r6 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x10000000000) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) (async) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x1e, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x130, 0x0, &(0x7f0000000c80)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1068, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x2000000000033}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x400000001, 0x8}, @flat=@binder={0x73622a85, 0x1000, 0x2}}, &(0x7f0000000240)={0x0, 0xfffffe78, 0x50}}, 0x1000}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @request_death={0x400c630e, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000b00)={@flat=@weak_handle={0x77682a85, 0x100, 0x1}, @flat=@weak_binder={0x77622a85, 0x10b, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x1}}, &(0x7f0000000b80)={0x0, 0x18, 0x30}}}, @free_buffer={0x40086303, r6}], 0x0, 0x0, 0x0}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 10, 7, 6, 30, 8, 14, 21] detailed listing: executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae03, 0x28) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x7, 0x8dc, 0xffffffbf, {}, {r1, r2/1000+10000}, {0x2, 0x1, 0x1}, 0x1, @can={{0x3ff, 0x1, 0x1}, 0x8, 0x0, 0x0, 0x0, "2064e7609a783858"}}, 0x48}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000b80)={0x14, 0x0, 0x2, 0x303, 0x0, 0x0, {0x5, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r3 = socket(0x10, 0x803, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000020000000800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x40) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x44800) sendmsg$NFQNL_MSG_CONFIG(r5, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000080)=ANY=[@ANYBLOB="30000000020301"], 0x30}, 0x1, 0x0, 0x0, 0x40840}, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f00000001c0)=""/17, 0x11}, {&(0x7f00000007c0)=""/141, 0x8d}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f0000000000)=""/39, 0x27}, {&(0x7f0000000040)=""/98, 0x62}], 0xa, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x2000, &(0x7f0000003700)={0x0, 0x3938700}) executing program 1: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') syz_pidfd_open(0x0, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x10000000) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000003140)={'sit0\x00', 0x0}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x61) copy_file_range(r1, 0x0, r1, 0x0, 0x1000000001ff, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4080000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0xd, r2, 0x200, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_usb_connect(0x0, 0x24, &(0x7f00000023c0)={{0x12, 0x1, 0x110, 0x68, 0x7a, 0x3d, 0x40, 0x19d2, 0x1255, 0x91, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x8, 0x38, 0x6, "", [{{0x9, 0x4, 0x9, 0x3, 0x0, 0x2, 0x6, 0x0, 0x9}}]}}]}}, 0x0) executing program 1: r0 = socket(0x6, 0x0, 0x3e) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000080)=0x5, 0x4) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32, @ANYBLOB="08004e01"], 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x4) (async) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd85d82, 0x0) executing program 1: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xd965, 0x800, &(0x7f0000000180)={0xc9, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) recvmmsg(r5, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/160, 0xa0}], 0x1}, 0x1}], 0x1, 0x2, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x10000000) (async) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000023c0)={0x0, 'vlan1\x00', {0xffe}, 0x6}) executing program 0: r0 = syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000020000402505a1a440000002030109025c0002010000000904000001020d0000052406000105241000000d240f0100000000060000010006241a0000000905810300020000000904010000020d00000904010102020d0000090582020002000000090503f53f39d33169b12395de019d9d8d07520c20664f05a7982976374e688c67f7f17c9dd09247bdb7fbcd84905d1bca7d24a81ebed7367b96c7f3d16eb5a8c6e2d2dbdafb00084b5b7618ad60c1918ce5a37e45fcbf660fb2916303b10dd6aeb6bc1731e8a1c757401e704723aac18830f01f278a797bf6eccb5ee5441341b3883dd3afd9d165a55220cfe0a2918efdc52e024eb9e3e44ef6bae1a0f47ad9c2d515298951651821c808159fbf09605617e11040a73626a3faa0ebdf2e5aed7dd8693b041b7299b5c6c1e5b33957b1c933748a"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) mkdir(&(0x7f0000000840)='./file0\x00', 0x145) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) setresgid(0x0, 0x0, 0xee01) utimes(&(0x7f0000000200)='./file0\x00', 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000080)={0x14, &(0x7f0000000040)={0x20, 0x34, 0xf, {0xf, 0x7, "c5984a926bc1433e2ed91f1d86"}}, &(0x7f0000000140)={0x0, 0x3, 0xf3, @string={0xf3, 0x3, "7bbc05a293951190558746304432ff5b195ce85e635b4b917859b61bf6fe0e2d82d2086f10acdea5a3bda37f7d39e933852367994b6e48f8344cfd9c589199ab1eea504469cbd204216e258fbd345289580ab8860cfac3c123099f845b13b76aafb271c860ecf818f9766a3a5f6449dd5852cd5995fc1a25cd5dd18a50dc553036c58662bb480f1184b3d7e847330b6f1e0a6f8f52b507b1243815562cad3c858d704bf4ae81010c8001babdb6ec5e5e54f4bb6bebe13cc04bb1774c8a85e3ea0379cca08493614541b2a867f1958a77d7afc9e53105e5aec7f9b8d577b265e6b7a584f38c929edb8d4ec9d23f94e28229"}}}, &(0x7f0000000540)={0x2c, &(0x7f0000000240)={0x40, 0x17, 0xa9, "30aa97c7a29bbb15c60e9583bf22411f9a170865fc80ccccf0598353b471483063c9a79e6ce69365b691b6322ace3b5a1395e7c5c388e0aad6a12a717941c714a04130eec77f81bdb130f931143ce0d8a86c37eaa3fe4836dbc0c2b929acd4d61580688d24f772500e818b2d52a6aa3e2b242f13254f2e21a6595fc1ecb8c23683e2c31df04e5eab34bbf31c30cfde7117dc7f0ce0b59de9cf480fc7d8da6288fbfb1d91b43cbb69c4"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x71}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f00000004c0)={0xc0, 0x5, 0x4, "9d642267"}, &(0x7f0000000500)={0x40, 0x5, 0x3, "6631fa"}}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000000c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x80, 0x1c, {0x401, 0xa08, 0xfffffffc, 0xb, 0x441, 0x5, 0x7fff, 0xfa97, 0x200, 0xd, 0x1fe, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = syz_usb_connect$midi(0x4, 0xd5, &(0x7f0000000580)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc3, 0x1, 0x1, 0x81, 0xa0, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x5, 0x1, 0x3, 0x20, 0x6, [@midi_out_jack={0xd, 0x24, 0x3, 0x5, 0xc, 0x3, [{0x81, 0x3}, {0x5, 0x1}, {0x0, 0xc}], 0x5}, @midi_in_jack={0x6, 0x24, 0x2, 0x3, 0xbb, 0x1}, @ms_header={0x7, 0x24, 0x1, 0x0, 0x7}, @ms_header={0x7, 0x24, 0x1, 0x2, 0x7}, @midi_out_jack={0x1b, 0x24, 0x3, 0x1, 0xf8, 0xa, [{0x0, 0x1}, {0xc4, 0x2}, {0x2, 0x2}, {0x5, 0x10}, {0x1, 0xfe}, {0x6f, 0x4}, {0x7, 0xeb}, {0x97, 0x3}, {0x4, 0x1}, {0x6, 0x7}], 0x17}, @ms_header={0x7, 0x24, 0x1, 0x8694, 0x7}, @midi_out_jack={0xb, 0x24, 0x3, 0x3, 0xf, 0x2, [{0x0, 0x9}, {0x4, 0x6}], 0x50}], [{{0x9, 0x5, 0xb, 0x8, 0x40, 0x42, 0x7, 0xd7, {0x5, 0x25, 0x1, 0x1, "b7"}}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x6, 0x9, 0x2, {0x6, 0x25, 0x1, 0x2, "5a04"}}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0x0, 0x9, 0x7, {0x11, 0x25, 0x1, 0xd, "63e0d2aef1ba9044087d93ee9a"}}}, {{0x9, 0x5, 0x6, 0x1, 0x40, 0x8, 0xab, 0x5, {0xf, 0x25, 0x1, 0xb, "24357be22ace8a114400b6"}}}, {{0x9, 0x5, 0x6, 0x3, 0x10, 0x5, 0x7, 0x3, {0xb, 0x25, 0x1, 0x7, "1e722b33df6063"}}}]}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x201, 0xb, 0x6, 0xb, 0x40, 0x40}, 0xc, &(0x7f00000006c0)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x6, 0x8, 0x3}]}, 0x9, [{0x29, &(0x7f0000000700)=@string={0x29, 0x3, "2da228eaf89cd9800317e0bcfbe01cd72e2daa896fd67ed16701f8ad53a618c6b3f8b66ea2e26c"}}, {0x85, &(0x7f0000000740)=@string={0x85, 0x3, "2169bbe23dcfcfae6287b32018b696f90fad071ac115733f1c1c5fa6cabb2dc5bbc3c1357de86b41b76c946046051a30b49f474ab599a17fedc3e4ea8206f48e69fc952a7ec236a7d669ea903f251d73f5e45b312c0d91aea361f2468d78ba954ebf009d5312cccfb32148f3cbdbf85dfd898f3afe207442d608de2855df1117ced247"}}, {0x20, &(0x7f0000000800)=@string={0x20, 0x3, "0de4fbc516933cd01aecd8b3dd856b25ab3be2626389fe578c26d2de54a1"}}, {0x79, &(0x7f0000000840)=@string={0x79, 0x3, "ac71f0493940d5399c567f50c1b6b5b9e5b9bf6c65c77329ddd7e6327a604f421b68ccf6a04032cfe33764a596de7429ac1b93d76c87e7710e7d3737ed67d984877600daf4671bae64798d5572340023c659b97cd299c01bc9b1f4420fdd8bd1aa3aa16cfaebf5a861a4c9110b34fb2fe23841635e5666"}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x424}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x455}}, {0x81, &(0x7f0000000940)=@string={0x81, 0x3, "7de67e2c7136835db6f141b73e8461d1846fe6f9108d1b3caee862a56da531e16e062720e6cb6e32396e13f6eeaabd9332bf8dec35360ab5334e08a7e6a491117435c8ec019e76205c044fa12b988c84e008e2a142dd8e71dc35a5b7da8d1a0f6f55204c6636000d656947de699cb32d59feb34ee19732a6d7f344bb3f9213"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x400a}}]}) syz_usb_control_io$uac3(r2, &(0x7f0000000bc0)={0x14, &(0x7f0000000b40)={0x40, 0x1, 0x24, {0x24, 0x23, "c2871af182cd43c9a70d25e86b7a87229f6db5469cac5703b86e9033dcb9ff884066"}}, &(0x7f0000000b80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1001}}}, &(0x7f0000000e80)={0x44, &(0x7f0000000c00)={0x40, 0xc, 0x8a, "03839ddd6d2009c08668ecb34b331e46591738eee731c47465d18a027cb25ca738407a976636b82afb31a91817b04bede0831613873f017f99b90804ecc4f2e21728ea3ae25f494865b0084060183510eb62c932c38d11d74113f21d8a4411e64029a08f6fe303239b3de19cf5c7170661538c426c9407f64b7df54f6a684eb060bfd62ff989217f86e2"}, &(0x7f0000000cc0)={0x0, 0xa, 0x1, 0x3b}, &(0x7f0000000d00)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000d40)={0x20, 0x81, 0x1, "8a"}, &(0x7f0000000d80)={0x20, 0x82, 0x3, "9ed852"}, &(0x7f0000000dc0)={0x20, 0x83, 0x1, '6'}, &(0x7f0000000e00)={0x20, 0x84, 0x3, "6fa8c1"}, &(0x7f0000000e40)={0x20, 0x85, 0x3, "0f800d"}}) executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) (async) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x109040, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) (async) r4 = dup3(r3, r2, 0x0) renameat2(r0, &(0x7f0000000280)='\x00', r0, &(0x7f00000002c0)='./file0\x00', 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) r6 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x10000000000) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) (async) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x1e, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x130, 0x0, &(0x7f0000000c80)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1068, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x2000000000033}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x400000001, 0x8}, @flat=@binder={0x73622a85, 0x1000, 0x2}}, &(0x7f0000000240)={0x0, 0xfffffe78, 0x50}}, 0x1000}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @request_death={0x400c630e, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000b00)={@flat=@weak_handle={0x77682a85, 0x100, 0x1}, @flat=@weak_binder={0x77622a85, 0x10b, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x1}}, &(0x7f0000000b80)={0x0, 0x18, 0x30}}}, @free_buffer={0x40086303, r6}], 0x0, 0x0, 0x0}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <8> bisect: split chunk #0 of len 8 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 8, 14, 21] detailed listing: executing program 1: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xd965, 0x800, &(0x7f0000000180)={0xc9, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) recvmmsg(r5, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/160, 0xa0}], 0x1}, 0x1}], 0x1, 0x2, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x10000000) (async) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000023c0)={0x0, 'vlan1\x00', {0xffe}, 0x6}) executing program 0: r0 = syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000020000402505a1a440000002030109025c0002010000000904000001020d0000052406000105241000000d240f0100000000060000010006241a0000000905810300020000000904010000020d00000904010102020d0000090582020002000000090503f53f39d33169b12395de019d9d8d07520c20664f05a7982976374e688c67f7f17c9dd09247bdb7fbcd84905d1bca7d24a81ebed7367b96c7f3d16eb5a8c6e2d2dbdafb00084b5b7618ad60c1918ce5a37e45fcbf660fb2916303b10dd6aeb6bc1731e8a1c757401e704723aac18830f01f278a797bf6eccb5ee5441341b3883dd3afd9d165a55220cfe0a2918efdc52e024eb9e3e44ef6bae1a0f47ad9c2d515298951651821c808159fbf09605617e11040a73626a3faa0ebdf2e5aed7dd8693b041b7299b5c6c1e5b33957b1c933748a"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) mkdir(&(0x7f0000000840)='./file0\x00', 0x145) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) setresgid(0x0, 0x0, 0xee01) utimes(&(0x7f0000000200)='./file0\x00', 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000080)={0x14, &(0x7f0000000040)={0x20, 0x34, 0xf, {0xf, 0x7, "c5984a926bc1433e2ed91f1d86"}}, &(0x7f0000000140)={0x0, 0x3, 0xf3, @string={0xf3, 0x3, "7bbc05a293951190558746304432ff5b195ce85e635b4b917859b61bf6fe0e2d82d2086f10acdea5a3bda37f7d39e933852367994b6e48f8344cfd9c589199ab1eea504469cbd204216e258fbd345289580ab8860cfac3c123099f845b13b76aafb271c860ecf818f9766a3a5f6449dd5852cd5995fc1a25cd5dd18a50dc553036c58662bb480f1184b3d7e847330b6f1e0a6f8f52b507b1243815562cad3c858d704bf4ae81010c8001babdb6ec5e5e54f4bb6bebe13cc04bb1774c8a85e3ea0379cca08493614541b2a867f1958a77d7afc9e53105e5aec7f9b8d577b265e6b7a584f38c929edb8d4ec9d23f94e28229"}}}, &(0x7f0000000540)={0x2c, &(0x7f0000000240)={0x40, 0x17, 0xa9, "30aa97c7a29bbb15c60e9583bf22411f9a170865fc80ccccf0598353b471483063c9a79e6ce69365b691b6322ace3b5a1395e7c5c388e0aad6a12a717941c714a04130eec77f81bdb130f931143ce0d8a86c37eaa3fe4836dbc0c2b929acd4d61580688d24f772500e818b2d52a6aa3e2b242f13254f2e21a6595fc1ecb8c23683e2c31df04e5eab34bbf31c30cfde7117dc7f0ce0b59de9cf480fc7d8da6288fbfb1d91b43cbb69c4"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x71}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f00000004c0)={0xc0, 0x5, 0x4, "9d642267"}, &(0x7f0000000500)={0x40, 0x5, 0x3, "6631fa"}}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000000c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x80, 0x1c, {0x401, 0xa08, 0xfffffffc, 0xb, 0x441, 0x5, 0x7fff, 0xfa97, 0x200, 0xd, 0x1fe, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = syz_usb_connect$midi(0x4, 0xd5, &(0x7f0000000580)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc3, 0x1, 0x1, 0x81, 0xa0, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x5, 0x1, 0x3, 0x20, 0x6, [@midi_out_jack={0xd, 0x24, 0x3, 0x5, 0xc, 0x3, [{0x81, 0x3}, {0x5, 0x1}, {0x0, 0xc}], 0x5}, @midi_in_jack={0x6, 0x24, 0x2, 0x3, 0xbb, 0x1}, @ms_header={0x7, 0x24, 0x1, 0x0, 0x7}, @ms_header={0x7, 0x24, 0x1, 0x2, 0x7}, @midi_out_jack={0x1b, 0x24, 0x3, 0x1, 0xf8, 0xa, [{0x0, 0x1}, {0xc4, 0x2}, {0x2, 0x2}, {0x5, 0x10}, {0x1, 0xfe}, {0x6f, 0x4}, {0x7, 0xeb}, {0x97, 0x3}, {0x4, 0x1}, {0x6, 0x7}], 0x17}, @ms_header={0x7, 0x24, 0x1, 0x8694, 0x7}, @midi_out_jack={0xb, 0x24, 0x3, 0x3, 0xf, 0x2, [{0x0, 0x9}, {0x4, 0x6}], 0x50}], [{{0x9, 0x5, 0xb, 0x8, 0x40, 0x42, 0x7, 0xd7, {0x5, 0x25, 0x1, 0x1, "b7"}}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x6, 0x9, 0x2, {0x6, 0x25, 0x1, 0x2, "5a04"}}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0x0, 0x9, 0x7, {0x11, 0x25, 0x1, 0xd, "63e0d2aef1ba9044087d93ee9a"}}}, {{0x9, 0x5, 0x6, 0x1, 0x40, 0x8, 0xab, 0x5, {0xf, 0x25, 0x1, 0xb, "24357be22ace8a114400b6"}}}, {{0x9, 0x5, 0x6, 0x3, 0x10, 0x5, 0x7, 0x3, {0xb, 0x25, 0x1, 0x7, "1e722b33df6063"}}}]}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x201, 0xb, 0x6, 0xb, 0x40, 0x40}, 0xc, &(0x7f00000006c0)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x6, 0x8, 0x3}]}, 0x9, [{0x29, &(0x7f0000000700)=@string={0x29, 0x3, "2da228eaf89cd9800317e0bcfbe01cd72e2daa896fd67ed16701f8ad53a618c6b3f8b66ea2e26c"}}, {0x85, &(0x7f0000000740)=@string={0x85, 0x3, "2169bbe23dcfcfae6287b32018b696f90fad071ac115733f1c1c5fa6cabb2dc5bbc3c1357de86b41b76c946046051a30b49f474ab599a17fedc3e4ea8206f48e69fc952a7ec236a7d669ea903f251d73f5e45b312c0d91aea361f2468d78ba954ebf009d5312cccfb32148f3cbdbf85dfd898f3afe207442d608de2855df1117ced247"}}, {0x20, &(0x7f0000000800)=@string={0x20, 0x3, "0de4fbc516933cd01aecd8b3dd856b25ab3be2626389fe578c26d2de54a1"}}, {0x79, &(0x7f0000000840)=@string={0x79, 0x3, "ac71f0493940d5399c567f50c1b6b5b9e5b9bf6c65c77329ddd7e6327a604f421b68ccf6a04032cfe33764a596de7429ac1b93d76c87e7710e7d3737ed67d984877600daf4671bae64798d5572340023c659b97cd299c01bc9b1f4420fdd8bd1aa3aa16cfaebf5a861a4c9110b34fb2fe23841635e5666"}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x424}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x455}}, {0x81, &(0x7f0000000940)=@string={0x81, 0x3, "7de67e2c7136835db6f141b73e8461d1846fe6f9108d1b3caee862a56da531e16e062720e6cb6e32396e13f6eeaabd9332bf8dec35360ab5334e08a7e6a491117435c8ec019e76205c044fa12b988c84e008e2a142dd8e71dc35a5b7da8d1a0f6f55204c6636000d656947de699cb32d59feb34ee19732a6d7f344bb3f9213"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x400a}}]}) syz_usb_control_io$uac3(r2, &(0x7f0000000bc0)={0x14, &(0x7f0000000b40)={0x40, 0x1, 0x24, {0x24, 0x23, "c2871af182cd43c9a70d25e86b7a87229f6db5469cac5703b86e9033dcb9ff884066"}}, &(0x7f0000000b80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1001}}}, &(0x7f0000000e80)={0x44, &(0x7f0000000c00)={0x40, 0xc, 0x8a, "03839ddd6d2009c08668ecb34b331e46591738eee731c47465d18a027cb25ca738407a976636b82afb31a91817b04bede0831613873f017f99b90804ecc4f2e21728ea3ae25f494865b0084060183510eb62c932c38d11d74113f21d8a4411e64029a08f6fe303239b3de19cf5c7170661538c426c9407f64b7df54f6a684eb060bfd62ff989217f86e2"}, &(0x7f0000000cc0)={0x0, 0xa, 0x1, 0x3b}, &(0x7f0000000d00)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000d40)={0x20, 0x81, 0x1, "8a"}, &(0x7f0000000d80)={0x20, 0x82, 0x3, "9ed852"}, &(0x7f0000000dc0)={0x20, 0x83, 0x1, '6'}, &(0x7f0000000e00)={0x20, 0x84, 0x3, "6fa8c1"}, &(0x7f0000000e40)={0x20, 0x85, 0x3, "0f800d"}}) executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) (async) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x109040, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) (async) r4 = dup3(r3, r2, 0x0) renameat2(r0, &(0x7f0000000280)='\x00', r0, &(0x7f00000002c0)='./file0\x00', 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) r6 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x10000000000) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) (async) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x1e, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x130, 0x0, &(0x7f0000000c80)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1068, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x2000000000033}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x400000001, 0x8}, @flat=@binder={0x73622a85, 0x1000, 0x2}}, &(0x7f0000000240)={0x0, 0xfffffe78, 0x50}}, 0x1000}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @request_death={0x400c630e, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000b00)={@flat=@weak_handle={0x77682a85, 0x100, 0x1}, @flat=@weak_binder={0x77622a85, 0x10b, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x1}}, &(0x7f0000000b80)={0x0, 0x18, 0x30}}}, @free_buffer={0x40086303, r6}], 0x0, 0x0, 0x0}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 21] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000020000402505a1a440000002030109025c0002010000000904000001020d0000052406000105241000000d240f0100000000060000010006241a0000000905810300020000000904010000020d00000904010102020d0000090582020002000000090503f53f39d33169b12395de019d9d8d07520c20664f05a7982976374e688c67f7f17c9dd09247bdb7fbcd84905d1bca7d24a81ebed7367b96c7f3d16eb5a8c6e2d2dbdafb00084b5b7618ad60c1918ce5a37e45fcbf660fb2916303b10dd6aeb6bc1731e8a1c757401e704723aac18830f01f278a797bf6eccb5ee5441341b3883dd3afd9d165a55220cfe0a2918efdc52e024eb9e3e44ef6bae1a0f47ad9c2d515298951651821c808159fbf09605617e11040a73626a3faa0ebdf2e5aed7dd8693b041b7299b5c6c1e5b33957b1c933748a"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) mkdir(&(0x7f0000000840)='./file0\x00', 0x145) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) setresgid(0x0, 0x0, 0xee01) utimes(&(0x7f0000000200)='./file0\x00', 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000080)={0x14, &(0x7f0000000040)={0x20, 0x34, 0xf, {0xf, 0x7, "c5984a926bc1433e2ed91f1d86"}}, &(0x7f0000000140)={0x0, 0x3, 0xf3, @string={0xf3, 0x3, "7bbc05a293951190558746304432ff5b195ce85e635b4b917859b61bf6fe0e2d82d2086f10acdea5a3bda37f7d39e933852367994b6e48f8344cfd9c589199ab1eea504469cbd204216e258fbd345289580ab8860cfac3c123099f845b13b76aafb271c860ecf818f9766a3a5f6449dd5852cd5995fc1a25cd5dd18a50dc553036c58662bb480f1184b3d7e847330b6f1e0a6f8f52b507b1243815562cad3c858d704bf4ae81010c8001babdb6ec5e5e54f4bb6bebe13cc04bb1774c8a85e3ea0379cca08493614541b2a867f1958a77d7afc9e53105e5aec7f9b8d577b265e6b7a584f38c929edb8d4ec9d23f94e28229"}}}, &(0x7f0000000540)={0x2c, &(0x7f0000000240)={0x40, 0x17, 0xa9, "30aa97c7a29bbb15c60e9583bf22411f9a170865fc80ccccf0598353b471483063c9a79e6ce69365b691b6322ace3b5a1395e7c5c388e0aad6a12a717941c714a04130eec77f81bdb130f931143ce0d8a86c37eaa3fe4836dbc0c2b929acd4d61580688d24f772500e818b2d52a6aa3e2b242f13254f2e21a6595fc1ecb8c23683e2c31df04e5eab34bbf31c30cfde7117dc7f0ce0b59de9cf480fc7d8da6288fbfb1d91b43cbb69c4"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x71}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f00000004c0)={0xc0, 0x5, 0x4, "9d642267"}, &(0x7f0000000500)={0x40, 0x5, 0x3, "6631fa"}}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000000c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x80, 0x1c, {0x401, 0xa08, 0xfffffffc, 0xb, 0x441, 0x5, 0x7fff, 0xfa97, 0x200, 0xd, 0x1fe, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = syz_usb_connect$midi(0x4, 0xd5, &(0x7f0000000580)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc3, 0x1, 0x1, 0x81, 0xa0, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x5, 0x1, 0x3, 0x20, 0x6, [@midi_out_jack={0xd, 0x24, 0x3, 0x5, 0xc, 0x3, [{0x81, 0x3}, {0x5, 0x1}, {0x0, 0xc}], 0x5}, @midi_in_jack={0x6, 0x24, 0x2, 0x3, 0xbb, 0x1}, @ms_header={0x7, 0x24, 0x1, 0x0, 0x7}, @ms_header={0x7, 0x24, 0x1, 0x2, 0x7}, @midi_out_jack={0x1b, 0x24, 0x3, 0x1, 0xf8, 0xa, [{0x0, 0x1}, {0xc4, 0x2}, {0x2, 0x2}, {0x5, 0x10}, {0x1, 0xfe}, {0x6f, 0x4}, {0x7, 0xeb}, {0x97, 0x3}, {0x4, 0x1}, {0x6, 0x7}], 0x17}, @ms_header={0x7, 0x24, 0x1, 0x8694, 0x7}, @midi_out_jack={0xb, 0x24, 0x3, 0x3, 0xf, 0x2, [{0x0, 0x9}, {0x4, 0x6}], 0x50}], [{{0x9, 0x5, 0xb, 0x8, 0x40, 0x42, 0x7, 0xd7, {0x5, 0x25, 0x1, 0x1, "b7"}}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x6, 0x9, 0x2, {0x6, 0x25, 0x1, 0x2, "5a04"}}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0x0, 0x9, 0x7, {0x11, 0x25, 0x1, 0xd, "63e0d2aef1ba9044087d93ee9a"}}}, {{0x9, 0x5, 0x6, 0x1, 0x40, 0x8, 0xab, 0x5, {0xf, 0x25, 0x1, 0xb, "24357be22ace8a114400b6"}}}, {{0x9, 0x5, 0x6, 0x3, 0x10, 0x5, 0x7, 0x3, {0xb, 0x25, 0x1, 0x7, "1e722b33df6063"}}}]}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x201, 0xb, 0x6, 0xb, 0x40, 0x40}, 0xc, &(0x7f00000006c0)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x6, 0x8, 0x3}]}, 0x9, [{0x29, &(0x7f0000000700)=@string={0x29, 0x3, "2da228eaf89cd9800317e0bcfbe01cd72e2daa896fd67ed16701f8ad53a618c6b3f8b66ea2e26c"}}, {0x85, &(0x7f0000000740)=@string={0x85, 0x3, "2169bbe23dcfcfae6287b32018b696f90fad071ac115733f1c1c5fa6cabb2dc5bbc3c1357de86b41b76c946046051a30b49f474ab599a17fedc3e4ea8206f48e69fc952a7ec236a7d669ea903f251d73f5e45b312c0d91aea361f2468d78ba954ebf009d5312cccfb32148f3cbdbf85dfd898f3afe207442d608de2855df1117ced247"}}, {0x20, &(0x7f0000000800)=@string={0x20, 0x3, "0de4fbc516933cd01aecd8b3dd856b25ab3be2626389fe578c26d2de54a1"}}, {0x79, &(0x7f0000000840)=@string={0x79, 0x3, "ac71f0493940d5399c567f50c1b6b5b9e5b9bf6c65c77329ddd7e6327a604f421b68ccf6a04032cfe33764a596de7429ac1b93d76c87e7710e7d3737ed67d984877600daf4671bae64798d5572340023c659b97cd299c01bc9b1f4420fdd8bd1aa3aa16cfaebf5a861a4c9110b34fb2fe23841635e5666"}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x424}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x455}}, {0x81, &(0x7f0000000940)=@string={0x81, 0x3, "7de67e2c7136835db6f141b73e8461d1846fe6f9108d1b3caee862a56da531e16e062720e6cb6e32396e13f6eeaabd9332bf8dec35360ab5334e08a7e6a491117435c8ec019e76205c044fa12b988c84e008e2a142dd8e71dc35a5b7da8d1a0f6f55204c6636000d656947de699cb32d59feb34ee19732a6d7f344bb3f9213"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x400a}}]}) syz_usb_control_io$uac3(r2, &(0x7f0000000bc0)={0x14, &(0x7f0000000b40)={0x40, 0x1, 0x24, {0x24, 0x23, "c2871af182cd43c9a70d25e86b7a87229f6db5469cac5703b86e9033dcb9ff884066"}}, &(0x7f0000000b80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1001}}}, &(0x7f0000000e80)={0x44, &(0x7f0000000c00)={0x40, 0xc, 0x8a, "03839ddd6d2009c08668ecb34b331e46591738eee731c47465d18a027cb25ca738407a976636b82afb31a91817b04bede0831613873f017f99b90804ecc4f2e21728ea3ae25f494865b0084060183510eb62c932c38d11d74113f21d8a4411e64029a08f6fe303239b3de19cf5c7170661538c426c9407f64b7df54f6a684eb060bfd62ff989217f86e2"}, &(0x7f0000000cc0)={0x0, 0xa, 0x1, 0x3b}, &(0x7f0000000d00)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000d40)={0x20, 0x81, 0x1, "8a"}, &(0x7f0000000d80)={0x20, 0x82, 0x3, "9ed852"}, &(0x7f0000000dc0)={0x20, 0x83, 0x1, '6'}, &(0x7f0000000e00)={0x20, 0x84, 0x3, "6fa8c1"}, &(0x7f0000000e40)={0x20, 0x85, 0x3, "0f800d"}}) executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) (async) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x109040, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) (async) r4 = dup3(r3, r2, 0x0) renameat2(r0, &(0x7f0000000280)='\x00', r0, &(0x7f00000002c0)='./file0\x00', 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) r6 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x10000000000) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) (async) syz_usb_connect$uac2(0x3, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000201e040030400001020301090292000301104002080b000201ff2004090400000001012000092401020009220000102402060502060403070000000503b50924070502000403000904010000010220000904010101010220001024010a04000200000004010400000609050109ff0302f5fd082501000c08010109040200000900200009040201010102200009058209400005077f082501800f010900"], 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x1e, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x130, 0x0, &(0x7f0000000c80)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1068, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x2000000000033}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x400000001, 0x8}, @flat=@binder={0x73622a85, 0x1000, 0x2}}, &(0x7f0000000240)={0x0, 0xfffffe78, 0x50}}, 0x1000}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @request_death={0x400c630e, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000b00)={@flat=@weak_handle={0x77682a85, 0x100, 0x1}, @flat=@weak_binder={0x77622a85, 0x10b, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x1}}, &(0x7f0000000b80)={0x0, 0x18, 0x30}}}, @free_buffer={0x40086303, r6}], 0x0, 0x0, 0x0}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 8] detailed listing: executing program 1: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xd965, 0x800, &(0x7f0000000180)={0xc9, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) recvmmsg(r5, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/160, 0xa0}], 0x1}, 0x1}], 0x1, 0x2, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x10000000) (async) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000023c0)={0x0, 'vlan1\x00', {0xffe}, 0x6}) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-getpid-syz_pidfd_open-setns-syz_clone-syz_pidfd_open-setns-ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x10000000) (async) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000023c0)={0x0, 'vlan1\x00', {0xffe}, 0x6}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir-mount$overlay-capset-chdir-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_int-sendto$packet-recvmmsg-mprotect detailed listing: executing program 1: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xd965, 0x800, &(0x7f0000000180)={0xc9, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) recvmmsg(r5, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/160, 0xa0}], 0x1}, 0x1}], 0x1, 0x2, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 1: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xd965, 0x800, &(0x7f0000000180)={0xc9, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) recvmmsg(r5, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/160, 0xa0}], 0x1}, 0x1}], 0x1, 0x2, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir-mount$overlay-capset-chdir-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_int-sendto$packet-recvmmsg-mprotect detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xd965, 0x800, &(0x7f0000000180)={0xc9, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) recvmmsg(r5, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/160, 0xa0}], 0x1}, 0x1}], 0x1, 0x2, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) program crashed: WARNING in shmem_rmdir bisect: concatenation succeeded found reproducer with 30 syscalls minimizing guilty program testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir-mount$overlay-capset-chdir-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_int-sendto$packet-recvmmsg detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xd965, 0x800, &(0x7f0000000180)={0xc9, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) recvmmsg(r5, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/160, 0xa0}], 0x1}, 0x1}], 0x1, 0x2, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir-mount$overlay-capset-chdir-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_int-sendto$packet detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xd965, 0x800, &(0x7f0000000180)={0xc9, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir-mount$overlay-capset-chdir-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_int detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00'}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir-mount$overlay-capset-chdir-socket$packet-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001700)={'bridge0\x00'}) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir-mount$overlay-capset-chdir-socket$packet detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') socket$packet(0x11, 0x3, 0x300) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir-mount$overlay-capset-chdir detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) chdir(&(0x7f0000000140)='./bus\x00') program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir-mount$overlay-capset detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir-mount$overlay detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000a80)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat-mkdir detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat-mkdirat detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp-mkdirat detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$inet_tcp detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) socket$inet_tcp(0x2, 0x1, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir-ioctl$SNDRV_TIMER_IOCTL_SELECT detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000180)={{0x0, 0x3, 0x77, 0x0, 0x9}}) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6-chdir detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) chdir(&(0x7f00000001c0)='./bus\x00') program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp-bind$inet6 detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x14b20000}, 0x1c) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE-socket$inet6_icmp detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) socket$inet6_icmp(0xa, 0x2, 0x3a) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat-sendmsg$AUDIT_ADD_RULE detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="48040000f303100026bd7000ffdbdf2510000000020000000d000000080000000180ffff080000001e91000006000000080000000300000009000000040000000800000000000000000000000002000003000000ff0f0000ff030000747800000400000036000000ffff0000410800000900000000000000fae2000000080000ffffffff060000000700000002000000020000000a00000008000000d50000000100008001000000010000000800000008000000070000000e00000069000000070000002000000002000000d5020000060000000b00000027060000040000000300000001800000000001000f0000006500000009000000ffff000007000000050000008aee00000100000000010000280700000400000083970000020000000700000004000000090000000fa1015bed0100000400000004000000d0ab00001900000005000000030000000800000088840000010000000800000001f0ffff0a0000000c0000008fffffff00000000ffffff7f040000000900000080000000ffffffff0400000003000000f0ffffff08000000090000000200000080000000de0d000000000000020000000000000010000000e80e00000100000000080000050000004000000009000000ff07000008000000020000008000000000000000ff7f0000018000007694a70c020000000b000000feffffffbe0800000100000006000000040000000080000004000000060000000900000001000000060000000400000001000000dd9f00008800000003000000ff01000001800000ffffff7f000800000000000000020000020000000000000004000000faffffff00000000030000000100000006000000000000800000ac53070000001200000001010000010000000700000001010000060000004500000004000000d800000009000000ffff0000060000000800000080000000000040c407000000460d000004000000030000000f0000000400000000000100db0c000003000000ff7f0000010000000800000003000000fdffffff05000000040000009c00000009000000f9fa0000060000000600000008000000070000000900000000000000040000003602000008000000ff7f0000ffff000005000000feffffff05000000ab06000000000000080000000700000052000000000000c404000000ffffffff04000000050000000000000006000000000000000e000000020000000300000006000000010000800600000009000000040000000004000003000000080000000800000008000000ff7f0000ffff000007000000c9000000030000000200000006000000ac0c0000010000000900000009000000b4a900000700000003000000e004b005000000000100000007000000000000020000000000000000010000000300000000010000030000000400000007000000aa0f0000060000000400000009000000250000002500282f0021696e6372656d656e74616c2d66730000696e6372656d656e74616c2d667300000000"], 0x448}, 0x1, 0x0, 0x0, 0x80}, 0x880) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2-renameat detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) renameat(r1, &(0x7f00000002c0)='./file0\x00', r2, &(0x7f0000000400)='./bus/file0\x00') program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect-pipe2 detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe2(&(0x7f00000003c0), 0x80000) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD-mprotect detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs-epoll_ctl$EPOLL_CTL_MOD detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x80000002}) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mount$incfs(0x0, 0x0, &(0x7f0000000000), 0x2020, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-ioctl$BINDER_WRITE_READ detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r1}, @fd, @fda={0x66646185, 0xa, 0x1, 0xd}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) program did not crash testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-syz_open_procfs-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='status\x00') mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat$binderfs-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount$incfs detailed listing: executing program 0: mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0x1004002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=43.924063452s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir simplifying C reproducer testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=43.924063452s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true reproducing took 54m12.15811856s repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 0 PID: 366 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 0 UID: 0 PID: 366 Comm: syz-executor Not tainted syzkaller #0 4cdc09a83674403ae09eb79c4caea2b8730b48e4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 df 15 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 f2 e5 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc900011cfc60 EFLAGS: 00010293 RAX: ffffffff81f1c2ae RBX: ffff888126f34428 RCX: ffff88811462b900 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011cfc88 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000239f7c R12: dffffc0000000000 R13: 1ffff11024de688e R14: ffff888126f34470 R15: 0000000000000000 FS: 000055558b675500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b33963fff CR3: 00000001136f0000 CR4: 00000000003526b0 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3763 vfs_rmdir+0x3e0/0x560 fs/namei.c:4348 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x2a0 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x406/0x4a0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe20099d9d7 Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff874955d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe20099d9d7 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff87495690 RBP: 00007fff87495690 R08: 00007fff87496690 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff87496720 R13: 00007fe200a32050 R14: 00000000000070a5 R15: 00007fff87496760 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/366 CPU: 1 UID: 0 PID: 366 Comm: syz-executor Tainted: G W syzkaller #0 4cdc09a83674403ae09eb79c4caea2b8730b48e4 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:484 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x26a/0x560 fs/namei.c:4361 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x2a0 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x406/0x4a0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe20099d9d7 Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff874955d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe20099d9d7 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff87495690 RBP: 00007fff87495690 R08: 00007fff87496690 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff87496720 R13: 00007fe200a32050 R14: 00000000000070a5 R15: 00007fff87496760 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 8000000114109067 P4D 8000000114109067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 366 Comm: syz-executor Tainted: G B W syzkaller #0 4cdc09a83674403ae09eb79c4caea2b8730b48e4 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 dd dc 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 9c 0c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 ed RSP: 0018:ffffc900011cfca0 EFLAGS: 00010246 RAX: ffff88811462b900 RBX: 0000000000000000 RCX: ffff88811462b900 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011cfcb0 R08: ffffffff88b97947 R09: 1ffffffff1172f28 R10: dffffc0000000000 R11: fffffbfff1172f29 R12: ffff888126f34434 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055558b675500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 00000001136f0000 CR4: 00000000003526b0 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x26a/0x560 fs/namei.c:4361 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x2a0 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x406/0x4a0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe20099d9d7 Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff874955d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe20099d9d7 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff87495690 RBP: 00007fff87495690 R08: 00007fff87496690 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff87496720 R13: 00007fe200a32050 R14: 00000000000070a5 R15: 00007fff87496760 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 dd dc 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 9c 0c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 ed RSP: 0018:ffffc900011cfca0 EFLAGS: 00010246 RAX: ffff88811462b900 RBX: 0000000000000000 RCX: ffff88811462b900 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011cfcb0 R08: ffffffff88b97947 R09: 1ffffffff1172f28 R10: dffffc0000000000 R11: fffffbfff1172f29 R12: ffff888126f34434 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055558b675500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 00000001136f0000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 dd dc 95 ff call 0xff95dcf0 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 9c 0c ee ff call 0xffee0cc0 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: ed in (%dx),%eax final repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 0 PID: 366 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 0 UID: 0 PID: 366 Comm: syz-executor Not tainted syzkaller #0 4cdc09a83674403ae09eb79c4caea2b8730b48e4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 df 15 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 f2 e5 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc900011cfc60 EFLAGS: 00010293 RAX: ffffffff81f1c2ae RBX: ffff888126f34428 RCX: ffff88811462b900 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011cfc88 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000239f7c R12: dffffc0000000000 R13: 1ffff11024de688e R14: ffff888126f34470 R15: 0000000000000000 FS: 000055558b675500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b33963fff CR3: 00000001136f0000 CR4: 00000000003526b0 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3763 vfs_rmdir+0x3e0/0x560 fs/namei.c:4348 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x2a0 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x406/0x4a0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe20099d9d7 Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff874955d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe20099d9d7 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff87495690 RBP: 00007fff87495690 R08: 00007fff87496690 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff87496720 R13: 00007fe200a32050 R14: 00000000000070a5 R15: 00007fff87496760 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/366 CPU: 1 UID: 0 PID: 366 Comm: syz-executor Tainted: G W syzkaller #0 4cdc09a83674403ae09eb79c4caea2b8730b48e4 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:484 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x26a/0x560 fs/namei.c:4361 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x2a0 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x406/0x4a0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe20099d9d7 Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff874955d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe20099d9d7 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff87495690 RBP: 00007fff87495690 R08: 00007fff87496690 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff87496720 R13: 00007fe200a32050 R14: 00000000000070a5 R15: 00007fff87496760 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 8000000114109067 P4D 8000000114109067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 366 Comm: syz-executor Tainted: G B W syzkaller #0 4cdc09a83674403ae09eb79c4caea2b8730b48e4 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 dd dc 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 9c 0c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 ed RSP: 0018:ffffc900011cfca0 EFLAGS: 00010246 RAX: ffff88811462b900 RBX: 0000000000000000 RCX: ffff88811462b900 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011cfcb0 R08: ffffffff88b97947 R09: 1ffffffff1172f28 R10: dffffc0000000000 R11: fffffbfff1172f29 R12: ffff888126f34434 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055558b675500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 00000001136f0000 CR4: 00000000003526b0 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x26a/0x560 fs/namei.c:4361 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd5/0x2a0 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x406/0x4a0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe20099d9d7 Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff874955d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe20099d9d7 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff87495690 RBP: 00007fff87495690 R08: 00007fff87496690 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff87496720 R13: 00007fe200a32050 R14: 00000000000070a5 R15: 00007fff87496760 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 dd dc 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 9c 0c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 ed RSP: 0018:ffffc900011cfca0 EFLAGS: 00010246 RAX: ffff88811462b900 RBX: 0000000000000000 RCX: ffff88811462b900 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011cfcb0 R08: ffffffff88b97947 R09: 1ffffffff1172f28 R10: dffffc0000000000 R11: fffffbfff1172f29 R12: ffff888126f34434 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055558b675500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 00000001136f0000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 dd dc 95 ff call 0xff95dcf0 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 9c 0c ee ff call 0xffee0cc0 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: ed in (%dx),%eax